How can I add SSHFP records (or any arbitrary records) on Windows DNS Server?
I'm running a DC with Windows 2012 R2 and would like to put the SSH keys of the Unix servers on the DNS.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
As was noted in another answer, none of the Microsoft tools for MSDNS (
Add-DnsServerResourceRecord) appear to have any ability to add an
Additionally, these tools also don't appear to have the ability to add records of arbitrary types using the standardized generic opaque record format (ie,
type<typeno> # <length> <hexencodedRRdata>).
However, MSDNS does support the dynamic update protocol, something which actually does make it possible to add
SSHFP records to zones hosted MSDNS!
While adding the record does work and the record is queryable afterwards, I do suggest caution as you're likely in mostly untested territory. This may not be suitable for production use.
These initial steps can be done through whichever method you prefer (
dnsmgmt.msc works fine, for instance):
Then, using the regular
dig tools from BIND:
C:\Users\Administrator\Downloads\BIND9.10.2.x64>nsupdate > server localhost > zone example.com > update add foo.example.com 3600 IN SSHFP 2 1 CC17F14DA60CF38E809FE58B10D0F22680D59D08 > send >
And to verify that the record exists:
C:\Users\Administrator\Downloads\BIND9.10.2.x64>dig @localhost foo.example.com sshfp +dnssec ; <<>> DiG 9.10.2 <<>> @localhost foo.example.com sshfp +dnssec ; (2 servers found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53553 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4000 ;; QUESTION SECTION: ;foo.example.com. IN SSHFP ;; ANSWER SECTION: foo.example.com. 3600 IN SSHFP 2 1 CC17F14DA60CF38E809FE58B10D0F22680D59D08 foo.example.com. 3600 IN RRSIG SSHFP 8 3 3600 20150426201836 20150416191836 46761 example.com. rO98HgBwZSCdsHIf/svgKV+ShLGDonandqrRE1Fe0RdhiJiK S/B0c28g vFCVijPqDBhxbCsY/OBh5AsF/LpZMZjE5erIIliq6E8yIlPMyiN+MabQ Sxm8Pwfo9V/GeiG7MlmgBOArHp+rYWhA2X3GFpzb9xTiequppbB1GMao iz8= ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Thu Apr 16 20:32:45 Coordinated Universal Time 2015 ;; MSG SIZE rcvd: 249 C:\Users\Administrator\Downloads\BIND9.10.2.x64>
SSHFP is currently not available and I am waiting for it, too.
Windows DNS Server has very limited options for
RRType to prevent you adding incompatible data. While the GUI has specific fields for every part of the record, some of them as drop down menus, also
dnscmd /RecordAdd and PowerShell Cmdlet
Add-DnsServerResourceRecord has the same limitations for
RRTypes and their data.
RRType is currently limited to
The supposed future
SSHFP type would therefore have three parameters according to RFC4255:
dnscmd /RecordAdd <Zone> <NodeName> SSHFP <Algorithm> <FP type> <Fingerprint>
SSHFP RRType becomes available, as Andrew B mentioned, you must first meet two conditions:
SSHFPrecord must be signed. Otherwise it will not improve your security at all.
Therefore, the first question to ask is how to enable DNSSEC on Windows server. It's good that you have Windows Server 2012 R2, since the support in 2008 R2 was limited to offline signing of static zones and it didn't support
Since this question wasn't about DNSSEC on Windows Server in general, I'll only leave this rather practical TechNet article as homework: Step-by-Step: Demonstrate DNSSEC in a Test Lab