bind and dhcp3 shared key

Question

I am trying to configure bind to accept updates from the dhcp server, I have made the changes to the dhcpd.conf file to refer to the appropriate zones and the rndc.key password file but when I restart the dhcp server I get :

Can't open /etc/bind/rndc.key: Permission denied

rndc.key has permissions 640, group and owner is bind.

If I change rndc.key to have permissions of 666 it works, but this is insecure is there a better way?

Ubuntu 11.04

Answer 1

For me, using rndc.key for DHCP updates seems to be a strange idea. (I googled some debian manual that used such a setup, maybe that is where it originates from). Besides, according to bind manual, rndc.key is kept just for backward compatibility with bind8.

What I'd suggest is the following: for DHCP, insert the following statement directly in both named.conf and your DHCP configuration file:

key "zone-updates-key" {
        algorithm       hmac-md5;
        secret          "lgkbhjhtthgtlghtl6567==";
};

(of course change the secret phrase ;) , you may generate random one by running rndc-confgen)

There's no need for any "include rndc.key" statements. Now into zone config in named.conf you add

allow-update { key "zone-updates-key"; };

and in dhcp zone config:

key zone-updates-key;

That's all. Both files should be readable by their respective processes, as usual.

** You may choose to stop here as well **

For rndc, you may run rndc-confgen and use it's output in rndc.conf and named.conf - this way bind will not use rndc.key at all.

(As for why not to use rndc.key for dynamic updates: this key gives complete control over bind, and there's no reason to compromise that if all you need is dynamic updates for single zone.)

Alternatively, in newer bind versionss, there's /var/run/named/session.key that may be helpful - have a look at "session-..." bind directives.