Bug #43670 for bind9-public: Warn on seeing trusted-keys option in config

In message <rt-4.2.8-6373-1479354393-1893.43670-3-0@isc.org>, "Mukund Sivaraman via RT" writes: > Warren Kumari asked today (IETF meeting) that we warn whenever we notice a tr > usted-keys option in config, that it is a fixed trust anchor and that users s > hould ideally be using managed-keys. > > I asked him (and Jim Martin who was sitting next to him) if he expected BIND > to warn just for the root or for any trust point and he said it should be any > . > > From a previous discussion at ICANN with him, I think he fears that many BIN > D tutorials from history have described using trusted-keys, and so, many user > s have resolvers setup with use trusted-keys in config. managed-keys are for keys where the adminstrator has stated they they are using RFC 5011. I know of exactly two of these. The root and dlv.isc.org. Warning for "." and "dlv.isc.org" when they match the built-in managed keys would be appropriate. Warning for keys in both trusted-keys and managed-key would be appropriate. Anything else should not be flagged. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org

---

On Thu, Nov 17, 2016 at 03:56:57AM +0000, Mark Andrews via RT wrote: > Warning for "." and "dlv.isc.org" when they match the built-in > managed keys would be appropriate. Somehow this ticket seems to have dropped off the radar. Please review rt43670. Mukund

---

On Thu Feb 08 09:10:07 2018, muks wrote: > On Thu, Nov 17, 2016 at 03:56:57AM +0000, Mark Andrews via RT wrote: > > Warning for "." and "dlv.isc.org" when they match the built-in > > managed keys would be appropriate. > > Somehow this ticket seems to have dropped off the radar. > > Please review rt43670. > > Mukund > No!!! Named is used in private networks where trusted-keys for the root is perfectly appropriate. dlv.isc.org already has plenty of warnings. A warning for a trusted-key for "." which matches the to be removed key without the added key already being present would be the point where I would issue a warning. Anything else is going to generate noise or is us enforcing our policy ideas on the operator. Also all this code should be bin lib/bind9/check.c

---

check the specific keys we are worried about. moved the checks to libbind so than named-checkconf issues warnings. ready for review

---

> ready for review I think it might be a good idea for KSK2010 trusted-key, without any other keys, to be fatal instead of a warning. As a managed-key can be a warning. Maybe add a suggestion to remove it from named.conf and rely on bind.keys? I would consider being more verbose in the DLV warnings and saying ISC DLV is shut down. The code itself is fine.

---