https://github.com/laurobmb/ansible_bind_dnssec
DNSSEC implementation using Ansible, this project aims to help the understanding of RedHat's Ansible tool by implementing a DNSSEC from scratch
https://github.com/laurobmb/ansible_bind_dnssec
ansible ansible-playbooks centos8 dns dns-server dnssec dnssecurity
Last synced: 2 months ago
JSON representation
DNSSEC implementation using Ansible, this project aims to help the understanding of RedHat's Ansible tool by implementing a DNSSEC from scratch
- Host: GitHub
- URL: https://github.com/laurobmb/ansible_bind_dnssec
- Owner: laurobmb
- Created: 2020-05-28T02:09:09.000Z (about 6 years ago)
- Default Branch: master
- Last Pushed: 2023-01-24T23:16:37.000Z (over 3 years ago)
- Last Synced: 2023-03-08T20:57:48.357Z (over 3 years ago)
- Topics: ansible, ansible-playbooks, centos8, dns, dns-server, dnssec, dnssecurity
- Language: Shell
- Homepage:
- Size: 17.6 KB
- Stars: 0
- Watchers: 2
- Forks: 0
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# DNSSEC in podman with CentOS 8
##### note
note: The keys must be in the code before uploading the container, these within the project serve as an example.
## Configure
In the file ***files/authority.zone*** configure the zone that the DNS must respond to, as well as the IP addresses of the hosts.
In the file ***files/reverse.zone*** configure the reverse zone that the DNS must respond to, as well as the IP addresses of the hosts.
#### Gerar Chave KSK e ZSK
The configuration of the keys is very important for the functioning of DNSSEC, execute:
***dnssec-keygen -r /dev/urandom -a RSASHA256 -b 4096 -f KSK -n ZONE [ domínio que você escolheu ]***
***dnssec-keygen -r /dev/urandom -a RSASHA256 -b 1024 -n ZONE [ domínio que você escolheu ]***
Include the generated keys in the file ***files/authority.zone*** (already have an example inside the file)
Run the scripts to create the domain DSSET and the first signature:
- reassina.sh
- reassina.reverse.sh
The file ***files/entrypoint.sh*** needs changes, in it you put the IP addresses so that when the container goes up, the podman can re-sign the zone.
***files/named.conf*** needs changes too, here you must enter the domain.
> zone "[ domínio que você escolheu ]" IN {
> type master;
> file "authority.zone.signed";
> allow-update { none; };
> };
>
> zone "123.168.192.in-addr.arpa" IN {
> type master;
> file "reverse.zone";
> allow-update { none; };
> };