DNSSEC support in Clustering

benny@cpanel.net ● 10 months ago

Unfortunately no news yet, but this hasn't fallen out of our view. As soon as I have more information I'll be back to let everyone know!

11

James Tandy ● 2 years ago

Providers are supposed to operate between 2 and 7 DNS servers as part of the RFC requirements.

Therefore not having cluster support for DNSSEC makes it pretty pointless for us atm.

Please add this sooner rather than later.

Reply URL

3

nshah14285 ● 2 years ago

When this feature will available with cPanel DNSONLY version?

Reply URL

1

benny@cpanel.net ● 2 years ago

It's not on the roadmap yet, but it's definitely something we want to see added!

URL

1

PH-Jay ● 2 years ago

The implementation of DNSEC on DNS only should be a priority over the clustering solution.

URL

5

carlosbss ● 2 years ago

DNSSEC is essential to be available in the cluster. We are not going to shutdown a cluster because of DNSSEC!! PowerDNS in the cluster and DNSSEC is the way to go now...

Make it happen cPanel :-)

Reply URL

4

Teotónio Ricardo ● 2 years ago

Without support for cluster, DNSSEC + PowerDNS support is useless. Hope this gets implemented soon. :)

Reply URL

2

Richard VandenHoven ● 2 years ago

We'd like to see DNSSEC support added to our cPanel DNS Clusters as well.

We're unable to use DNSSEC at the moment although it's already supported in cPanel.

Hope to see it arrive in version 62.

Reply URL

3

pointaction ● 2 years ago

This is a must have. I have 3 DNS Only Servers with 5 Web Servers clustered at the moment and DNSSEC is really needed in this envioment to help secure websites and server even more.

Reply URL

5

Kristian Liivak ● 2 years ago

Standaone dns server dnssec is so pointless. Smaller service providers usually dont implement such features. Cluster support is what we need

Reply URL

2

Travis Ellis ● 2 years ago

Hello Everyone,

I am the Product Owner of the team that implemented DNSSEC in the first place. I want to take a second to talk about some of the issues that we are currently facing with doing DNSSEC on clustered systems.

DNSSEC data is stored in a local sqlite db on the cPanel & WHM server
That data needs to be shared with all systems in the cluster
That data contains private data could be compromised if not transferred securely
We would need a way to determine which data goes with which servers and when to delete the data when a record is resigned

We have been looking at several different methods of solving these issues.

The simplest would be a sqlite clustering option across all servers. You would have a separate sqlite db for each server in your cluster that the server containing the domains in the sqlite db would be the master and the other servers would simply mirror the data for that sqlite file. This could get quite messy, but would be the most accurate to the way we currently approach clustering.

The way I would prefer is to do a more overhauled solution to clustering that uses AXFRs. If you have worked much with the current DNS admin system in cPanel & WHM, you will know this is a vast departure from current functionality. This would require a lot more work and would take more time.

I would love to get your feedback to determine which solution would fit your customers needs.

Reply URL

3

Daniel ● 2 years ago

I'm all for a "quick & dirty" approach that closes the current gap in security features (in comparison to other interfaces) faster. To be honest, the whole clustering setup can get messy very quickly if you have multiple servers pushing to it anyway.

URL

2

JonTheWong ● 2 years ago

If its about time, i'd rather have a master SQLite db running on a standalone server, have all servers contacts it for information. Easier to manage and would not load up new processes on the frontend web systems. Long term would be to have the DNSonly system merged into this or ideally Have DNSOnly / SQLOnly / MailOnly forks. But thats a topic for another comment.

Reply URL

1

James Tandy ● 2 years ago

I'd give a massive thumbs up to the 'containerised' MailOnly, SQLonly and DNSonly ideas.

For now however, lets just get DNS fixed :)

In the past we have run a homebrew SQLonly pair of boxes, with master/master replication, sitting behind a pair of HAproxy boxes, with a fleet of 18 cpanel servers accessing them purely via the haproxy ip.

This however required custom scripts/hooks to enforce username uniqueness across all the cpanel boxes, and an ugly hack to join a machine to the sql cluster due to cpanels insistence on ssh'ing to the remote sql server as root in order to run some scripts.

This did however run without issue for well over 2 years, so demonstrates that the idea is not only feasible, but has been achieved albeit manually in the past.

Regards mailonly, this would be an enourmous plus for cpanel, as we could then have one or two primary mail exchangers, running mailscanner, and all the fluff, and would give the bayesian filters a much greater chance of detecting spam, compared to the bayes filter being local to each server.

I'd still expect all mail to actually be stored on the target cpanel server, and also still be used for webmail etc, but would give a 'single' point we need to expose to the world for inbound SMTP.

(Feel free to copy/paste this into the relevant feature requests)

Back to DNSonly, I'm against the idea of having a single 'master' sqlite db, as the whole point of a cluster is that *any* server can fail, without affecting the operation of the rest of the cluster in any way.

Im honestly at a loss though why the entire DNS operation can't be achieved using dns and AXFR requests.

The members of the dns cluster just need to trust each other, and in theory this would also allow a mixing of different dns servers, eg bind and nsd, rather than being forced to run one type of dns server on every machine.

I'd rather it take longer, but be done right, than rushing and bodging it!

URL

1

Monarobase ● 2 years ago

With the current bind system, I believe DNS is sent over cPanel's API. would it be complicated to do the same for DNSSEC data ?

Reply URL

1

benny@cpanel.net ● 2 years ago

Travis is out this week, but as soon as he's back in the office I'll make sure he's back here to respond to your feedback!

Reply URL

1

Travis Ellis ● 2 years ago

@Monarobase,

We can stream it over the DNSAdmin API. However that system is a bit more cumbersome to work on, so we are evaluating all of the options before we commit to anything.

Our current focus for SpiderPig in 64 will be including a more standardized API token based authentication system.

Reply URL

4

BehrendsTech ● 2 years ago

Just do what a lot of the service providers do already (as a patch for dns security) and create a hash for each account that you can regen when you want to with that database. Obviously there are better approaches but since DNS hijacking/mitm is becoming more common a simple solution would be better than years with no solution.

Reply URL

2

Floki ● 2 years ago

DNSSEC in the cluster is realy needed and as cpanel as standalone dns already supports it cant be so hard to develope.

So hurry guys!

Reply URL

2

benny@cpanel.net ● 2 years ago

It definitely seems like it should be easy, but introducing the cross-server interactions means there's a lot more that would need to be added to the product in order to do it right. The first step in doing it right here is the new token system that we released in version 64, which you can read about here:

https://documentation.cpanel.net/display/SDK/Guide+to+API+Authentication+-+API+Tokens

https://documentation.cpanel.net/display/64Docs/Manage+API+Tokens

URL

6

Zach M ● 22 months ago

I really really really want to see this implemented soon. I think the feature should be top priority. Any updates on progress?

Reply URL

1

benny@cpanel.net ● 22 months ago

Unfortunately, this isn't something we're adding quite yet, but it's still a high-priority for us. As soon as we're able to get any forward motion on this, I'll be back to update everyone.

URL

5

Wojciech Babicz ● 22 months ago

I can confirm. This is next thing in cpanel which "exists theoretically" but it is unusable. We are using clustering, so we need dnssec with clustering. Dnssec without clustering is pointless.

I have couple of political/government site which have in his new requirements using dnssec. I would like not to loos this customers...

Wojtek

URL

1

benny@cpanel.net ● 22 months ago

@Wojtek: Thanks for the feedback, and for the use-case. There's definitely a use for DNSSEC without clustering, though I do understand that it's not as useful for many of our webhosting providers.

URL

7

James Tandy ● 22 months ago

Most of your larger customers will use clusters.

This makes it more important than standalone server support for DNSSEC imho.

URL

5

Teotónio Ricardo ● 22 months ago

As already said, DNSSEC without clustering is pointless. I'm pretty sure that every webhosting provider that really knows what is doing, wants this feature as soon as possible.

URL

2

ethical ● 22 months ago

So I use an outside DNS service that takes requests using AXFR. I was told that they should support and accept dnssec signed record however with the new powerdns and dnssec setting set, the zone transfers were failing.

Short story is I had to edit /etc/pdns/pdns.conf to allow the IPs of my dns provider first.

I have since learned that cpanel signs the records using nsec3 narrow version, which prevents AXFR from working! (yes apparently its a tiny bit better for preventing zone walking but please i am sure our customers are not going to be major targets for hackers with the kind of time to do all that work).

I also learned that we need to remove the narrow signing for it to work (and possibly this needs to be done for the cpanel dns only clustering to work as well?)

so here is my workaround

I have edited the file that creates the record (thanks Michael B for the help) located here: /usr/local/cpanel/Cpanel/NameServer/Conf/PowerDNS.pm

which allows me to sign records without the narrow and thus my zone transfers now work properly however now I am in the boat that this file will get overwritten on future cpanel updates but hopefully with some progress on this front, it wont be for long.

this is what i did

change this line

my $return = _run_pdnssec( { 'args' => [ 'set-nsec3', $domain, $params, ( $config->{'nsec3_narrow'} ? 'narrow' : '' ) ] } );

to this line

my $return = _run_pdnssec( { 'args' => [ 'set-nsec3', $domain, $params, ] } );

now when you create a DNSSEC zone in the cpanel, it will create it without narrow which allows for AXFR to work.

thanks!

p.s. i think it should be added to the feature request to allow the ability for us as administrators to choose how we sign the dnssec record (using nsec3 narrow or not).

URL

1

Anders Bjørnerud ● 22 months ago

We are also supporting seeing this feature as soon as possible!

In Norway the registry for .no, NORID, actually gives a rebate on domain registrations for domains registered with DNSSEC. Since we are using clustering in cPanel to handle our DNS service and thus are using clustering (off course), we are actually loosing money using cPanel! The rebate is about $3 per domain registration, and with a normal price of about $7 for .no domains, we miss out on a large profit possibility here!

I really hope cPanel will consider speeding up implementation for DNSSEC support when using clustering!

URL

1

asturmas ● 20 months ago

Same here, any update about that? DNSSEC without cluster support dont help or make sense.

Reply URL

2

Roberto Santin ● 19 months ago

Dear cPanel staff,

This feature is 100% a must for today "operational standards" as dnssec will be a "defacto" standard.

That being said, I hope you're already working for an implementation of this feature.

Hope to hear good news very soon.

Thanks for your great job @ Cpanel ..

Kind Regards.

Admin

Reply URL

1

Sup M8 ● 11 months ago

Any update on DNSSEC support? As part of security and questions of the customers, we need it enabled.

Reply URL

1

Michael Findlay ● 11 months ago

Any news on clustered support for DNSSec?

Reply URL

1

Qarizma ● 11 months ago

Is there any progress regarding DNSSEC in a cluster? It's very important for us because customers are requesting it to comply with certain laws and rules. They are now forced to use other solutions.

Reply URL

1

benny@cpanel.net ● 10 months ago ●

Unfortunately no news yet, but this hasn't fallen out of our view. As soon as I have more information I'll be back to let everyone know!

Reply URL

3

Luke Jones ● 7 months ago

Please can we have an update on this? More and more customers are requesting this especially since Europe did the whole GDPR thing everyone is starting to look at data security as a whole in a much closer light and some that previously were unsure what DNSSEC even was are now requesting this as standard and having to migrate customers from a robust clustered server set to a single stand alone server is at best a stop gap.

Reply URL

2

Wojciech Babicz ● 6 months ago

We need DNSsec in cluster urgently becouse of ICANN

https://www.us-cert.gov/ncas/current-activity/2018/09/27/DNSSEC-Key-Signing-Key-Rollover

Reply URL

3

Monarobase ● 6 months ago

Luckily the change they announced in the above article, doesn't affect domains that don't use DNSSEC.

Organizations that do not use DNSSEC validation will be unaffected by the rollover.

URL

1

Wojciech Babicz ● 6 months ago

lucky ! but ... you know ... :-)

URL

2

benny@cpanel.net ● 6 months ago

Hi all! I can't give you a definitely timeline on this one yet, but as soon as we have one I'll post it here.

Reply URL

7

James Tandy ● 6 months ago

This should be top priority for the next build of cpanel DNSonly in my opinion.

We too have a growing number of users expecting DNSSEC as standard, which is currently impossible due to us running a dns cluster (using bind)

URL

5

Wojciech Babicz ● 5 months ago

any update and progress ?

URL

1

Denis Gorsz ● 3 months ago

hi we also would like to see this feature would make a huge difference in DNS feature list we could provide to clients if we would switch to cpanel.

URL

2

Leigh Morrow ● 54 days ago

Any updates on this? Seems ICANN is stepping up pressure we need a solution from cPanel

https://www.icann.org/news/announcement-2019-02-22-en

URL

7

Monarobase ● 53 days ago

We have had a few requests for DNSSEC recently because of the ICANN’s warnings that some newspapers have extrapolated and made sound like the whole of internet is going down!

Almost all articles mention that ICANN recommends DNSSEC…

Customers don’t understand what it is but now know they want it! :)

Reply URL

1

Wojciech Babicz ● 52 days ago

Right! I also don't understand that cPanel has no clear plan to implement it

Reply URL

4

eXite ● 51 days ago

Although I understand the challenges that the cPanel development team faces in revamping the DNS and DNS Clustering implementation, I am pretty disappointed that it's apparently taking this long to come up with a solid plan. There has been SO much talk about European GDPR standards among IT-managers over the past years, that security related features such as DNSsec have become paramount in business use cases. DNSsec support without support for DNS Clustering is de facto useless for most implementations. I can't sell "Reliability or security, which one do you prefer?".

Reply URL

4

benny@cpanel.net ● 51 days ago

Hey folks! There's no solid update at this time, still, but it was a topic of conversation among our product owners yesterday. As soon as I have one I'll let you know!

Reply URL

7

Floki ● 36 days ago

It is impossible for cluster dns setups to sell hosting towards most government or company related services, DNSSEC is a must have and as already mentioned before GDPR causes DNSSEC to be a must have. If this doesent move we have to migrate our whole DNS system.

2 years ago the request was opend, nothing yet. We already lost several customers or had to setup some of them own nameserver because nothing moves here.

We understand that the dns cluster implementation needs to be planned wise, but seems it havent been started yet, so i assume it will still take a long time untill we see it.

Reply URL

2

Kristian Liivak ● 36 days ago

Tottally agree. Such delay is unintelligible

Reply URL

DNSSEC support in Clustering

Comments (48)