Rotating TSIG keys associated with a view - BlueCat Integrity - 26.1.0

Address Manager Administration Guide
ft:locale
en-US
Product name
BlueCat Integrity
Version
26.1.0

In Address Manager v26.1.0, views now contain a hidden seed (salt) value for the generation of TSIG keys, which can be regenerated from the view actions menu for TSIG key rotation.

Integrity uses server-pair TSIG keys to authenticate remote server-to-server zone transfer traffic, previously configured using the TSIG Key for Server Pair DNS deployment option. In Integrity v26.1.0, each view now contains a unique hidden seed (salt) value that is used during remote TSIG key generation for increased security. This new seed value, along with internal TSIG key naming improvements, has eliminated the need for the TSIG Key for Server Pair DNS deployment option. It is now default behaviour to generate unique TSIG keys for each server pair, and new server-pair TSIG keys are generated with the view's seed value, instead of the previously defined Key salt value from the DNS deployment option. As such, the TSIG Key for Server Pair option has been removed from Address Manager.

Integrity also generates local TSIG keys for each view, which are used by DNS/DHCP Servers to authenticate local control traffic such as dynamic deployments and local Incremental Zone Transfer Protocol (IXFR) harvesting. For v26.1.0 DNS/DHCP Servers, local TSIG keys are now generated on the DNS/DHCP Server side and rotated each time a full deployment is performed. For v25.1.x and earlier DNS/DHCP Servers controlled by Address Manager v26.1.0, the new view seed value will be used to generate local TSIG keys for DNS/DHCP Servers, and these keys can be rotated on demand.

Tip: Integrity v26.1.0 applies the following naming conventions for TSIG keys on DNS/DHCP Server:

VIEW<VIEW_ID> - local TSIG keys generated for DNS/DHCP Servers version 25.1.x and earlier.

VIEW<VIEW_ID>_<SERVER_ID> - local TSIG keys generated for DNS/DHCP Servers version 26.1.0 and later.

VIEW<VIEW_ID>_<PRIMARY_SERVER_ID>_<SECONDARY_SERVER_ID> - remote server-pair TSIG keys.

A view's seed value can be regenerated on demand from the Address Manager UI, allowing users to manually rotate local (DNS/DHCP Server v25.1.x and earlier) and server-pair TSIG keys as needed.

To rotate TSIG keys for a view:

  1. Select the DNS tab in the sidebar, then select Views.
  2. Select the row actions button (⋮) for the view that you would like to rotate TSIG keys for, then select Rotate TSIG keys.
    Note: Rotating generates a new key. Other servers that rely on the old key must be updated. This action can't be undone.
  3. Select the acknowledgement checkbox.
  4. Enter a Change control comment, if required.
  5. Select Rotate.
After rotating TSIG keys for a view in the Address Manager UI, you must perform a full deployment so that DNS/DHCP Servers are updated with the new TSIG keys.