Editing HSM-enabled DNS Servers - BlueCat Integrity - 9.4.0

Address Manager Administration Guide

Locale
English
Product name
BlueCat Integrity
Version
9.4.0

Edit the name, deployment options, and HSM settings of managed DNS/DHCP Server appliances and VMs.

Note: DO NOT edit multiple HSM-enabled DNS/DHCP Servers at the same time

BlueCat advises customers not to attempt to take more than one DNS/DHCP Server under Address Manager control at the same time while enabling HSM. For example, from multiple browser tabs or windows, or from multiple admin users working in parallel (not necessarily from the same workstation). Doing so can result in misconfiguration of the DNS/DHCP Server.

Note: If editing an HSM-enabled DNS Server for use in an xHA pair, edit the server, making sure to enable HSM support from the Edit Server page, then create xHA. For more information, refer to OPTIONAL: Editing an HSM-enabled xHA pair.

To edit HSM on managed DNS Servers:

  1. Select the Servers tab. Tabs remember the page you last worked on, so select the tab again to ensure you're on the Configuration information page.
  2. Under Servers, click the name of the managed DNS Server you wish to edit.
  3. Click the server name menu and select Edit.
  4. Under Server, edit the following:
    • Profile—select the model number of your DNS Server from the drop-down menu.
      Note: If you want to use the monitoring service, you must first enable SNMP on each DNS/DHCP Server you intend to monitor. For details, refer to Enabling monitoring services for DNS/DHCP Server.
    • Name—enter the name for the server. This name is used only in the Address Manager user interface and isn't associated with deployed DNS data.
    • Management Interface—enter the IPv4 or IPv6 address configured on the eth0 interface in the BDDS Administration Console. If Dedicated Management is enabled, enter the IPv4 or IPv6 address configured on the eth2 interface.
      Note: If editing a server, the Management Interface field is only available after you have first disabled the managed DNS/DHCP Server. If you want to change the IP address of the Management interface (eth2), you must first re-configure the IP address of the Management interface using the DNS/DHCP Server Administration Console, disable the server in Address Manager, then edit the server with the new IP address.
    • Hostname—The host name used for the server on the network. For example, myhost.example.com
    • Location(Optional) select a location from the drop-down menu on which the server object that you are adding or editing will be based. The most often used location objects will be shown at the top of the list followed by all other lists in alphabetical order.
  5. Under Validation Options, set the following options to override DHCP and DNS services configuration or DNS zones validation settings configured at the configuration level:
    • Override configuration level DHCP validation settings—select the check box to set DHCP deployment validation options that are specific to the server. If selected, the Enable DHCP configuration validation check box appears.
      • Enable DHCP configuration validation—select the check box to check the syntax of the dhcpd.conf file and validate data prior to deployment from Address Manager.
    • Override configuration level DNS validation settings—select the check box to set deployment validation options that are specific to the server. If selected, the Enable DNS configuration validation and Enable DNS zones validation check boxes appear:
      • Enable DNS configuration validation—select the check box to check the syntax of the named.conf file and validate data prior to deployment from Address Manager.
      • Enable DNS zones validation—select the check box to check the syntax of each DNS zone file and validated data prior to deployment from Address Manager. This is equivalent to setting the -i switch for the named-checkzone tool. If selected, the DNS Zones Deployment Validation Setting section opens on the page.
  6. Under DNS Zones Validation Settings, complete the following:
    • Post-load zone integrity validation—performs syntax checks based on the mode you select for this option. Select one of the following modes:
      • Full—checks for the following conditions:
        • If MX records refer to A or AAAA records, for both in-zone and out-of-zone hostnames.
        • If SRV records refer to A or AAAA records, for both in-zone and out-of-zone hostnames.
        • If Delegation NS records refer to A or AAAA records, for both in-zone and out-of-zone hostnames
        • If glue address records in the zone match those specified by the child.
      • Local—checks for the following conditions:
        • If MX records refer to A or AAAA records, for in-zone hostnames.
        • If SRV records refer to A or AAAA records, for in-zone hostnames.
        • If Delegation NS records refer to an A or AAAA record, for in-zone hostnames.
        • If glue address records in the zone match those specified by the child.
      • Full-sibling—performs the same checks as in Full mode but doesn't check the glue records.
      • Local-sibling—performs the same checks as in Local mode but doesn't check the glue records.
    • None—disables all post-load zone integrity checks.
    • Check names—Checks names. Select Ignore, Warn, or Fail to determine how Address Manager handles conditions found by this check.
    • Check if MX records are IP addresses—checks if MX records point to an IP address rather than an A or AAAA record. This is equivalent to setting the -M switch for the named-checkzone tool. Select Ignore, Warn, or Fail to determine how Address Manager handles conditions found by this check.
    • Check if MX records point to CNAME records—checks if MX records point to a CNAME record rather than an A or AAAA record. This is equivalent to setting the -M switch for the named-checkzone tool. Select Ignore, Warn, or Fail to determine how Address Manager handles conditions found by this check.
    • Check if NS records are IP addresses—checks if NS record point to an IP address rather than an A or AAAA record. This is equivalent to setting the -n switch for the named-checkzone tool. Select Ignore, Warn, or Fail to determine how Address Manager handles conditions found by this check.
    • Check if SRV records point to CNAME records—checks is SRV record point to a CNAME record rather than A or AAAA record. This is equivalent to setting the -S switch for the named-checkzone tool. Select Ignore, Warn, or Fail to determine how Address Manager handles conditions found by this check.
    • Check for non-terminal wildcards—checks for wildcards in zone names that don't appear as the last segment of a zone name: for example, mail.*.example.com. Non-terminal wildcards are permissible, but you may want to be alerted to their presence. This is equivalent to setting the -W switch for the named-checkzone tool. Select Ignore or Warn to determine how Address Manager handles conditions found by this check.
    For the preceding options, Ignore, Warn, or Fail have the following effects:
    • Ignore—Ignores the condition, so it isn't logged in the Zone Validation server log. Deployment proceeds with the zone data containing the condition.
    • Warn—Logs the condition in the Zone Validation server log. Deployment proceeds with the zone data containing the condition.
    • Fail—Logs the condition in the Zone Validation server log. Deployment fails. The existing DNS data is left in place and the new data isn't deployed.
  7. Under Kerberos Service Principal, set the DNS and DHCP service principals:
    • Enable DNS Service Principal—select to specify the security credential for the DNS service to use to authenticate keys requested by the GSS-TSIG protocol. When you select this check box, Realm and Principal fields appear. Select a Kerberos realm and service principal from the Realm and Principal drop-down menus.
    • Enable DHCP Service Principal—select this check box to specify the security credential for the DHCP service to use to authenticate keys requested by the GSS-TSIG protocol. When you select this check box, Realm and Principal fields appear. Select a Kerberos realm and service principal from the Realm and Principal drop-down list.
  8. Under HSM Support, complete the following:
    • Select the check box, Enable HSM Support. The Add Server page refreshes to show your HSM configuration and a drop-down menu of HSM servers.
    • From the HSM Servers drop-down menu, select an HSM server and click Add. Repeat this step to add multiple HSM servers.
    • To re-order the hierarchy of the HSM servers in the list, select an HSM server and click Move Up or Move Down. The HSM server at the top of the order will be the Primary; HSM servers below the Primary will be the Secondary, Tertiary. Click Remove to delete an HSM server from the list.
  9. Under Change Control, add comments, if required.
  10. Click Update.

In the General section of the Details tab, you will see Enable HSM Support: Yes — this confirms that HSM has been enabled on the managed BlueCat DNS Server. Also, the HSM Servers section lists the HSM server(s) linked to your managed DNS Server.