unkinben/puppet-bind
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Parameterize the random device for dnssec-keygen

Browse Source 
`dnssec-keygen` uses `/dev/random` by default, but this is slow in some
scenarios where `/dev/urandom` is both faster and provides sufficient utility.
Allow override via the `bind::random_device` hiera key.
This commit is contained in:
Nate Riffe 2015-07-03 08:59:59 -05:00
parent 2cafc226f0
commit e25dbfc529
4 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
data/common.yaml
View File

@ -4,5 +4,6 @@ bind::params::supported: false
bind::forwarders: '' bind::forwarders: ''
bind::dnssec: true bind::dnssec: true
bind::version: '' bind::version: ''
bind::random_device: '/dev/random'
bind::updater::keydir: '/etc/nsupdate-keys' bind::updater::keydir: '/etc/nsupdate-keys'

5
files/dnssec-init
View File

@ -4,7 +4,8 @@ CACHEDIR="$1"
NAME="$2" NAME="$2"
DOMAIN="$3" DOMAIN="$3"
KEY_DIRECTORY="${4:-${CACHEDIR}/${NAME}}" KEY_DIRECTORY="${4:-${CACHEDIR}/${NAME}}"
RANDOM_DEVICE="$5"
PATH=/bin:/sbin:/usr/bin:/usr/sbin PATH=/bin:/sbin:/usr/bin:/usr/sbin
dnssec-keygen -K "${KEY_DIRECTORY}" "${DOMAIN}" dnssec-keygen -r "${RANDOM_DEVICE}" -K "${KEY_DIRECTORY}" "${DOMAIN}"
dnssec-keygen -f KSK -K "${KEY_DIRECTORY}" "${DOMAIN}" dnssec-keygen -r "${RANDOM_DEVICE}" -f KSK -K "${KEY_DIRECTORY}" "${DOMAIN}"
dnssec-signzone -S -d "${CACHEDIR}" -K "${KEY_DIRECTORY}" -o "${DOMAIN}" "${CACHEDIR}/${NAME}/${DOMAIN}" dnssec-signzone -S -d "${CACHEDIR}" -K "${KEY_DIRECTORY}" -o "${DOMAIN}" "${CACHEDIR}/${NAME}/${DOMAIN}"

1
manifests/init.pp
View File

@ -9,6 +9,7 @@ class bind (
$version = undef, $version = undef,
$rndc = undef, $rndc = undef,
$statistics_port = undef, $statistics_port = undef,
$random_device = undef,
) { ) {
include ::bind::params include ::bind::params

3
manifests/zone.pp
View File

@ -21,6 +21,7 @@ define bind::zone (
# where there is a zone, there is a server # where there is a zone, there is a server
include bind include bind
$cachedir = $::bind::cachedir $cachedir = $::bind::cachedir
$random_device = $::bind::random_device
$_domain = pick($domain, $name) $_domain = pick($domain, $name)
unless !($masters != '' and ! member(['slave', 'stub'], $zone_type)) { unless !($masters != '' and ! member(['slave', 'stub'], $zone_type)) {
@ -109,7 +110,7 @@ define bind::zone (
if $dnssec { if $dnssec {
exec { "dnssec-keygen-${name}": exec { "dnssec-keygen-${name}":
command => "/usr/local/bin/dnssec-init '${cachedir}' '${name}'\ command => "/usr/local/bin/dnssec-init '${cachedir}' '${name}'\
'${_domain}' '${key_directory}'", '${_domain}' '${key_directory}' '${random_device}'",
cwd => $cachedir, cwd => $cachedir,
user => $::bind::params::bind_user, user => $::bind::params::bind_user,
creates => "${cachedir}/${name}/${_domain}.signed", creates => "${cachedir}/${name}/${_domain}.signed",