0

Here is what I am trying to do:

Use TSIG to validate the DNS transaction : Query and Response.

I know that TSIG is generally used between two hosts for secured zone transfers. But, I am trying to validate a simple Query from my client using TSIG. I have generated a private key at the server using dnssec-gen tool and then appended a TSIG record at the client side to the outgoing DNS query message.

I am not sure how to enable the BIND server to validate TSIG RR on the incoming query. I have just added a key configuration in the named.conf file which matches with the TSIG RR signed at the client side. When I receive the TSIG signed DNS query at the server side, the following error message is shown:

request has invalid signature: TSIG mytsigkey: tsig verify failure (BADSIG)

But, I strongly feel the MAC I have generated and appended to the DNS query record is correct (I verified it with the Slavasoft HMAC calculator). I am not sure if I am missing anything in the named.conf file.

Below is the config. Any inputs are highly appreciated.

key "mytsigkey" {
        algorithm hmac-md5;
        secret "AsZN6W/8HJiHoFFaLh/4xg==";
};
options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     {any ;};
        recursion yes;
        allow-transfer {key test_tsig.com;};

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";
};
Dan Lowe
  • 51,713
  • 20
  • 123
  • 112
Gopi
  • 13
  • 2
  • TSIG validation requires the sender and receiver to have closely synchronized clocks. Check that before you dig into more complicated possibilities. – Calle Dybedahl Aug 25 '15 at 09:15
  • @CalleDybedahl : There is no issue with the clock synchronization, I made sure that both the clocks are synchronized. The error would have been BADTIME if the clocks are not synchronized. – Gopi Aug 25 '15 at 16:56
  • Just wanted to share the reason behind the BADSIG error. I used dnssec-keygen tool to generate the TSIG key and this generated in base64 encoded format. When I pass the same key my client to do digest operation, I didn't convert the key from the base46 to ascii. – Gopi Aug 28 '15 at 02:24

0 Answers0