2

just realized after installing bind-9.9.4-P2, there is a ./etc/bind.keys file already installed. I have looked at their explanation here but have no clue what this is for still.

Can someone please let me know if I need to secure this key also by making it only readable by root, similar to how I'd do the same for the rndc.conf file?

user192702
  • 931
  • 5
  • 15
  • 22

1 Answers1

1

There is nothing "sensitive" in the bind.keys file that you would need to secure so that it cannot be read by normal users - it contains "trust anchors" for DNSSEC (the initial data used to validate the root zone, and for DLV).

You should however ensure that the file is not WRITABLE by regular users (or the user BIND runs as) - in fact there is no need for the file to be writable at all. It should not need updating frequently (if at all), and should you need to replace it you can do so as root.

Community
  • 1
voretaq7
  • 79,879
  • 17
  • 130
  • 214