English

Español

English

Español

Appearance

Set up BIND9 to allow dynamic DNS updates ​

Sources:

This guide explains how to configure BIND to allow dynamic DNS updates using the RFC 2136 protocol. This allows CertGuardian to create or modify DNS records automatically.

rc2136 package installation ​

Install the bind9utils package to allow the use of the nsupdate command:

bash
apt install -y bind9utils

Generate rfc2136 key ​

Generate a TSIG key that will allow communication between CertGuardian and BIND:

bash
tsig-keygen ddnskey >> /secrets/ddnskey

Then, print the content con the generated TSIG key:

bash
cat /secrets/ddnskey

Save the key because it will be needed to configure the DNS zone.

Update the BIND zone ​

Edit the zone file:

bash
vi /etc/bind/named.conf.local

Add the generated TSIG key in the previous step and allow it to update the corresponding zone using allow-update:

bind
key "ddnskey" { 
        algorithm hmac-sha256;
        secret "xxxxxxxxxxxxxxxxxxxxx";
};

zone "david.es" {
        type master;
        file "/etc/bind/db.zonad";
        allow-update { key "ddnskey"; };
};

INFO

Replace david.es and the value of secret with the real values of your configuration.

Restart the BIND service to apply the changes:

bash
systemctl restart bind9

Test the dynamic DNS update ​

From other machine, run the command nsupdate and add the generated TSIG key with the -k parameter:

bash
nsupdate -k /secrets/ddnskey

The command will open an interactive console. Type the following lines, changing the server, zone matching your setup:

bash
server 127.0.0.1
zone david.es
update add www.david.es 180 A 192.168.0.150
send

If the send runs without errors, the DNS update has been successfully performed. Check the DNS zone to verify that the record has been added with dig:

bash
dig @127.0.0.1 www.david.es A

INFO

Replace @127.0.0.1 with the IP address of the DNS server you are using.

CertGuardian configuration ​

To connect CertGuardian to BIND, CertGuardian needs to have the Certbot plugin for BIND installed. The plugin is this pip package: https://pypi.org/project/certbot-dns-rfc2136/

[[add-new]]

Crear servidor DNS ​

Navigate to Certificate management -> DNS providers

Crear claves DNS ​

dns_rfc2136_server = 127.0.0.1
dns_rfc2136_port = 53
dns_rfc2136_name = ddnskey.
dns_rfc2136_secret = xxxxxxxxxx
dns_rfc2136_algorithm = HMAC-SHA256
dns_rfc2136_sign_query = false