PowerPoint Presentation

-94

TSIG configuration steps 1-3

1. Create key using DNSSEC-keygen:

dnssec-keygen -a HMAC-MD5 -b 256 -n HOST me-friend

Kme-friend.+157+51197

2. Cut-n-paste key material into named.conf

key Óme-friend." {

algorithm hmac-md5;

secret ÒnEfRX9jxOmzsby8VKRgDWEJorhyNbjt1ebbPn7lyQtE=";

};

3. Communicate this with your partner (off band, PGPÉ)


	The DNSSEC-keygen -n HOST will create a key pair. The key material is the same in both the private and public part of the key.


	Ônamed.confÕ is normally world readable. To protect your keys put them in a separate root only readable ÒkeyfileÓ and use include ÒkeyfileÓ; in your named.conf.