TSIG keys - BlueCat Integrity - 26.1.0

Address Manager Administration Guide
ft:locale
en-US
Product name
BlueCat Integrity
Version
26.1.0

Define Transaction Signature (TSIG) keys used for DDNS updates and secure zone transfers.

You can define Transaction Signature (TSIG) keys in Address Manager for the following functions:
  • to allow a DHCP Server to perform secure DDNS updates to a DNS server.
  • to allow a DNS Server to receive secure DDNS updates from a DDNS client.
  • to secure zone transfers and other DNS deployment options.
Attention:

The TSIG Key Server Pair DNS deployment option has been removed from Address Manager v26.1, as starting in v26.1 server-pair TSIG keys are generated with a seed value contained by the view. Ensure that both primary and secondary DNS/DHCP Servers in a server pair are running the same version, as different software levels may result in deployment or zone transfer failures.

To create a TSIG key, you specify a name for the key, an algorithm, and the length of the key in bits. Address Manager can create the key value automatically, or you can manually type a Base64-encoded string for the key. Use the manual option when you need to add keys that already exist on your DNS and DHCP servers to Address Manager.

You define TSIG keys in the TSIG keys tab at the configuration level (Global > Configurations). Keys defined here can be used in DNS deployment options set anywhere in the configuration, and in DHCP forward and reverse zones. Keys intended for use with DNS deployment options to secure DDNS updates and zone transfers may use any of the available algorithms. For more information on using TSIG keys with DNS deployment options, refer to DNS deployment options.

When viewing the details for a TSIG key, you can view the objects to which it's linked. You can't delete a TSIG key if it's linked to or used by another Address Manager object. Should a key become compromised, you can perform an emergency rollover to regenerate the key. After regenerating one or more TSIG keys, you need to deploy the configuration to your server or servers.
Tip: What's a “compromised” key?

A compromised key can mean part (or all) of the key has been deciphered through cryptographic analysis by a malicious attacker, or a malicious attacker has gained physical access to the keys. In either case, new keys must be generated in order to preserve the security of your DNS/DHCP environment.