Idle State

I've just been playing around with DDNS on Fedora again. I do this every few months on a new box so this post is as much an aide mémoire for myself as much as anything, however, others might find it useful. The DHCP DNS interaction on linux seems to be quite poorly Howto'd despite best intentions.

I'm working with an FC8 box. Here's the highlights (I mean, the description is deliberately terse) of the configuration that you need to make Secure DDNS work:

Make An Update Key

Fedora comes with rndc.key supplied. I suggest not using a well known generic key. Generate your own like so:

  dnssec-keygen -a HMAC-MD5 -b 512 -n HOST somehost.somedomain.com

This will create your public and private keys. Copy the .key into the update key file you want to use (I use update.key)

The generation process may appear to hang due to a lack of entropy - so if this is the case, open a window and start typing the World's Greatest Novel in another window on the server.

The Key File Format

It should look something like this:

  key somehost.somedomain.com. {

    algorithm HMAC-MD5;

    secret "Nd2+awholelotofseeminglyrandomstuff /moreseeeminglyrandomstuff==";

  };

SELinux and Keyfiles

If you're using SELinux, the context of the key file should, for dhcpd, should be:

  [etc]# ls -Z update.key

  -rw-r-----  root named system_u:object_r:dnssec_t:s0 update.key

SELinux will complain if it's not set to this - so use chcon to fix it if necessary.
dhcpd.conf
Important parts are these:

  ddns-domainname "somedomain.com" ;

  ddns-update-style interim ;

  ddns-ttl 86400;

  key somehost.somedomain.com. {

    algorithm HMAC-MD5 ;

    secret ##$$##$$##$$ put your public key data here ;

  }

  zone somedomain.com. {

    primary 127.0.0.1 ;

    key somehost.somedomain.com. ;

  }

  zone 1.168.192.in-addr.arpa. {

    primary 127.0.0.1 ;

    key somehost.somedomain.com. ;

  }

In the subnet section:

  subnet 192.168.1.0 netmask 255.255.255.0

  {

    ...

    ignore-client-updates ;

    ddns-updates on ;

    ...

  }

Now, the named.conf file:

In each zone that you want to allow updates:

  zone "somedomain.com" IN {

    ...

    allow-update {

      key somehost.somedomain.com. ;

    }

    ....

  };

or, if you prefer more control

  zone "somedomain.com" IN {

    ...

    update-policy

    {

      grant somehost.somedomain.com. subdomain somedomain.com. TXT ;

    }

    ...

  };

and do something similar in the reverse lookup zone and

  include "/etc/update.key";

That's it.

Config testing can be done with:

  named-checkconf
  service dhcpd configtest

Which will show you if you have any issues with your configs before restarting (they are noisy on error only).

I'm dubious about the results from configtest as you'll see later.

Test With nsupdate

Here's a completely uncommented example. Implies that the configs are fine and you've restarted at least named and checked /var/log/messages for anything additional:

  [etc]# nsupdate -k Ksomehost.somedomain.com.+157+08869.private 

  > server 127.0.0.1

  > zone somedomain.com.

  > update add newhost.somedomain.com. 86400 IN A 192.168.1.1

  > show

  Outgoing update query:

  ;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0

  ;; flags: ; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0

  ;; ZONE SECTION:

  ;somedomain.com.		IN	SOA

  ;; UPDATE SECTION:

  newhost.somedomain.com. 86400 IN A	192.168.1.1

  > send

  > quit

  [etc]# ping newhost

  PING newhost.somedomain.com (192.168.1.1) 56(84) bytes of data.

  64 bytes from somehost (192.168.1.1): icmp_seq=1 ttl=64 time=0.053 ms

  64 bytes from somehost (192.168.1.1): icmp_seq=2 ttl=64 time=0.029 ms

  --- newhost.somedomain.com ping statistics ---

  2 packets transmitted, 2 received, 0% packet loss, time 999ms

  rtt min/avg/max/mdev = 0.029/0.041/0.053/0.012 ms

Use update delete newhost.somedomain.com. A to remove the entry.

Key File Strangeness / Incompatibility

Unless I'm mistaken, it seems that named and dhcpd prefer the update.key file to be in slightly different format. named needs quotation marks surrounding the key or else it gives this error:

  [etc]# named-checkconf

  /etc/update.key:3: missing ';' before '/'

  /etc/update.key:3: '}' expected near '/'

However, dhcpd complains about the quotes:

  Feb 7 somehost dhcpd: /etc/update.key line 3: invalid base64 character 32.

  Feb 7 somehost dhcpd: #011secret "xxyyxxxyxyxyxyxyx /xixixkxxjxjx

  Feb 7 somehost dhcpd:            ^

  Feb 7 somehost dhcpd: /etc/update.key line 4: expecting a parameter or declaration

  Feb 7 somehost dhcpd: };

  Feb 7 somehost dhcpd: ^

  Feb 7 somehost dhcpd: /etc/dhcpd.conf line 24: /etc/update.key: bad parse.

  Feb 7 somehost dhcpd: include "/etc/update.key"

  Feb 7 somehost dhcpd:         ^

  Feb 7 somehost dhcpd: Configuration file errors encountered -- exiting

Strangely, this causes dhcpd to fail to start (which can be seen in logs) but it is not reported by config check.

I believe that dhcpd is at fault here - the config file should allow the quotation marks.

Versions

I'm using FC8 with Bind 9.5.0-23 and dhcp 3.0.6-12.

Some References

This article is great - very complete - even though it is now quite old:
my newbie DDNS-HOWTO http://www.lugs.org.sg/pipermail/slugnet/2003-January/002848.html

The following articles are great, but they don't have the dhcp config:
nsupdate: Painless Dynamic DNS http://linux.yyz.us/nsupdate/
Painless DDNS part 2: the server http://linux.yyz.us/dns/ddns-server.html