DNSSEC setup for dnsseed #85

Emzy · 2020-10-07T14:29:20Z

Documentation to run a bind9 with DNSSEC in front of the bitcoin-seeder

README-dnssec.md

contrib/dnsupdate

README-dnssec.md

Emzy · 2020-10-30T11:47:55Z

@ysangkok thank you for the review. Very appreciated.
I'm still learning to use Github. So I hope I did it all right.

Sjors · 2023-03-10T12:55:45Z

@Emzy just noticed this PR :-) Can you rebase the PR on top of master, and also squash the commits with duplicate names?

Emzy · 2023-03-10T13:31:15Z

Just did that. Looks like it was already rebased to master.

Sjors · 2023-03-10T14:31:49Z

@Emzy after a rebase there shouldn't be a commit [Merge branch 'sipa:master' into master] left though.

Emzy · 2023-03-10T15:31:05Z

Sorry, I'm still try to master git.
I think I got it now into the right state.

Sjors · 2023-03-10T16:17:57Z

That worked. But to further improve your mastery, try git rebase -i HEAD~5, and then replace pick with fixup for the second line (it should run hourly). That'll squash it into the first commit. You can also try Github Desktop which just lets you drag one commit into another.

Emzy · 2023-03-10T16:25:01Z

Did exactly that. As a console user I prefer the git command line.

Sjors · 2023-03-10T19:52:47Z

Ok, might as well also squash 2bf3b63 in it, because:

it touch a file that is new in this PR
having it as a separate commit doesn't aid review, nor does it help later in debugging

b7b80ac makes (slightly) more sense as it's own commit, because the commit message explains the purpose of that line (which shows up in git blame)

I would squash 2d6a09c into the first commit, because the end result is more readable than the initial thing. So if I review a PR one commit at a time, I have to study the grep stuff, only to see it disappear a few commits later.

(I'd probably just squash this entire PR into one commit, but the above illustrates my thinking on commits)

Emzy · 2023-03-10T21:20:07Z

I agree, it makes sense to have it as just one commit.
Your guidance is very appreciated.

Sjors

So compared to the regular setup, we no longer forward (private) port 5353 to (public) port 53, and instead rely on the bind9 software? If so, you should mention that the PREROUTING step in the README should be skipped / undone.

If I understand the dnsupdate script correctly it only makes one call to the seeder. And the cronjob only runs that script hourly. So we'd end up with a very limited set of results (the seeder gives a differente result every time you call it). Could we instead run it every (couple of) seconds? Or bypass using dig and get the full (sorted) list directly?

When running the script manually I get update failed: SERVFAIL.

This is what it's trying to give to nsupdate -v:

server localhost
zone seed.bitcoin.sprovoost.nl
update delete seed.bitcoin.sprovoost.nl a
update delete seed.bitcoin.sprovoost.nl aaaa
update add seed.bitcoin.sprovoost.nl. 3600 A 80.121.88.109
...
update add seed.bitcoin.sprovoost.nl. 3600 AAAA 2a01:e0a:9:d30:2d6e:4e7f:455c:4b5
send

Sjors · 2023-08-21T13:00:26Z

contrib/dnsupdate

+  echo update delete ${ZONE} a
+  echo update delete ${ZONE} aaaa
+  for proto in A AAAA ; do
+        dig +noall +answer -t ${proto} -p 15353 @52.37.101.214 ${ZONE} | \


The IP here is replaced with where the seeder is running at?

Same below.

Can you the port, IP and domain a variable that's passed in an argument? That's more consistent the seeder command and easier when you have multiple seeds running on the same machine (mainnet, testnet, etc).

Sjors · 2023-08-21T13:08:46Z

README-dnssec.md

+## Software needed
+
+* Debian GNU/Linux 10
+* tor


I think you can drop Tor, because seeds were only able to announce Tor v2 addresses.

Sjors · 2023-08-21T13:46:12Z

README-dnssec.md

+```
+        querylog no;
+	allow-transfer { none; };
+	dnssec-enable yes;


option 'dnssec-enable' no longer exists

Looks like this line can dropped.

https://serverfault.com/questions/1105487/if-dnssec-enable-is-obsolete-and-must-be-removed-what-is-the-alternative-when

Sjors · 2023-08-21T13:50:36Z

README-dnssec.md

+
+* Check config
+```
+named-checkconf


This complains /etc/bind/named.conf.local:14: option 'auto-dnssec' is deprecated

Sjors · 2023-08-21T13:51:53Z

README-dnssec.md

+* Check config
+```
+named-checkconf
+named-checkzone dnsseed.example.com /var/lib/bind/db.dnsseed.example.com


What's the expected result of this?

$ named-checkzone seed.bitcoin.sprovoost.nl /var/lib/bind/db.seed.bitcoin.sprovoost.nl /var/lib/bind/db.seed.bitcoin.sprovoost.nl:3: ignoring out-of-zone data (dnsseed.example.com) /var/lib/bind/db.seed.bitcoin.sprovoost.nl:11: ignoring out-of-zone data (dummy) zone seed.bitcoin.sprovoost.nl/IN: has 0 SOA records zone seed.bitcoin.sprovoost.nl/IN: has no NS records zone seed.bitcoin.sprovoost.nl/IN: not loaded due to errors.

^ I got rid of the remaining dnsseed.example.com

But that leaves:

/var/lib/bind/db.seed.bitcoin.sprovoost.nl:11: ignoring out-of-zone data (dummy) zone seed.bitcoin.sprovoost.nl/IN: NS 'seed.bitcoin.sprovoost.nl' has no address records (A or AAAA) zone seed.bitcoin.sprovoost.nl/IN: not loaded due to errors.

Sjors · 2023-08-21T13:53:18Z

README-dnssec.md

+```
+
+* Restart Bind9
+`service bind9 restart`


This seems to succeed, though startup will have the same errors/warnings as above.

I may have accidentally deleted this service, but this still works: sudo systemctl restart named

Sjors · 2023-08-21T13:54:15Z

README-dnssec.md

+* Generate DNSSEC keys
+```
+cd /var/lib/bind
+dnssec-keygen -r /dev/urandom -a ECDSAP256SHA256 dnsseed.example.com`


` at the end?

Also:

dnssec-keygen: fatal: The -r option has been deprecated. System random data is always used.

Sjors · 2023-08-21T15:32:22Z

README-dnssec.md

+};
+```
+
+* /var/lib/bind/db.example.com


Did you mean /var/lib/bind/db.dnsseed-host.example.com or does this have to one level up?

Sjors · 2023-08-21T15:40:51Z

I also noticed that compared to the tutorial you're not adding a Zone Signing Key(ZSK). (nvm, you are, but not using the terminology)

Update: I think it works now, I had to use the hostname in one place - see above.

Sjors · 2023-08-21T15:45:51Z

README-dnssec.md

+
+* Sign zone
+```
+dnssec-signzone -A -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) -N INCREMENT -o example.com -t db.example.com


Did you mean -o dnsseed.example.com -t db.dnsseed.example.com or really the root domain?

Also my bind9 seems to insist that the signed output is in raw format, so adding -O raw

Sjors · 2023-08-21T15:51:39Z

README-dnssec.md

+```
+$ORIGIN .
+$TTL 3600       ; 1 hour
+dnsseed.example.com.        IN SOA  dnsseed-host.example.com. contact-email.example.com. (


I think I overlooked the -host bit here.

Sjors · 2023-08-21T17:39:32Z

It was a bit of a struggle to get all the key files in the right place. Not sure if I did it correctly, but at least this looks good:

I ended up putting all the keys in /etc/bind and also set key-directory "/etc/bind"; to that. All files there are owned by root:bind. Otherwise I kept getting errors that it wasn't finding this or that (private) key.

I used some cron-hack to make it update every 15 seconds, which is hopefully good enough for now.

Emzy mentioned this pull request Oct 7, 2020

ops: Enable DNSSEC on all Bitcoin DNS Seed domain names bitcoin/bitcoin#19714

Closed

9 tasks

ysangkok suggested changes Oct 27, 2020

View reviewed changes

Emzy force-pushed the master branch from 9962295 to e70acf8 Compare March 10, 2023 13:29

Emzy force-pushed the master branch 2 times, most recently from 0436cae to 8dc1a6a Compare March 10, 2023 15:24

Emzy force-pushed the master branch from 8dc1a6a to 2d6a09c Compare March 10, 2023 16:23

DNSSEC setup for dnsseed

9a30f62

Emzy force-pushed the master branch from 2d6a09c to 9a30f62 Compare March 10, 2023 21:15

Sjors suggested changes Aug 21, 2023

View reviewed changes

Sjors reviewed Aug 21, 2023

View reviewed changes

Emzy mentioned this pull request May 4, 2024

DNS seed "seed.bitcoinstats.com" doesn't support filtering while the comments says it does bitcoin/bitcoin#29911

Closed

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

DNSSEC setup for dnsseed #85

DNSSEC setup for dnsseed #85

Emzy commented Oct 7, 2020

Emzy commented Oct 30, 2020 •

edited

Loading

Sjors commented Mar 10, 2023

Emzy commented Mar 10, 2023

Sjors commented Mar 10, 2023

Emzy commented Mar 10, 2023 •

edited

Loading

Sjors commented Mar 10, 2023

Emzy commented Mar 10, 2023

Sjors commented Mar 10, 2023 •

edited

Loading

Emzy commented Mar 10, 2023

Sjors left a comment

Sjors Aug 21, 2023

Sjors Aug 21, 2023

Sjors Aug 21, 2023

Sjors Aug 21, 2023

Sjors Aug 21, 2023

Sjors Aug 21, 2023 •

edited

Loading

Sjors Aug 21, 2023

Sjors Aug 21, 2023

Sjors Aug 21, 2023

Sjors Aug 21, 2023

Sjors commented Aug 21, 2023 •

edited

Loading

Sjors Aug 21, 2023

Sjors Aug 21, 2023

Sjors Aug 21, 2023

Sjors commented Aug 21, 2023 •

edited

Loading

DNSSEC setup for dnsseed #85

Are you sure you want to change the base?

DNSSEC setup for dnsseed #85

Conversation

Emzy commented Oct 7, 2020

Emzy commented Oct 30, 2020 • edited Loading

Sjors commented Mar 10, 2023

Emzy commented Mar 10, 2023

Sjors commented Mar 10, 2023

Emzy commented Mar 10, 2023 • edited Loading

Sjors commented Mar 10, 2023

Emzy commented Mar 10, 2023

Sjors commented Mar 10, 2023 • edited Loading

Emzy commented Mar 10, 2023

Sjors left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Sjors Aug 21, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Sjors commented Aug 21, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Sjors commented Aug 21, 2023 • edited Loading

Emzy commented Oct 30, 2020 •

edited

Loading

Emzy commented Mar 10, 2023 •

edited

Loading

Sjors commented Mar 10, 2023 •

edited

Loading

Sjors Aug 21, 2023 •

edited

Loading

Sjors commented Aug 21, 2023 •

edited

Loading

Sjors commented Aug 21, 2023 •

edited

Loading