PowerDNS webfrontend - PowerDNS-Admin

2024 aasta kevade tähelepanekud

Eesmärk

• ühe operatsioonisüteemi peal kompaktselt lahenduse pidamine - Debian v. 12
• dns server - PowerDNS
• webgui haldusliides - PowerDNS-Admin (PDA)
• dnssec võimekus
• docker abil kasutatakse konteinerit (PDA)
• andmeid hoitakse PostgreSQL andmebaasis

Tööpõhimõte

Väited

• dnssec kasutab algoritmi nr 13
• NSEC3 kasutab '1 0 0 -' seadistust
• sekundaarsete nimeserveritega suhtlemine toimub catalog-zones abil
• kasutatakse KSK/ZSK ja CSK lähenemist võtmete pidamisel

Protseduuride võimekus

• NSEC, NSEC3 ja NSEC3 param väärtuste muutmine
• võtme vahetus
• krüptimise algoritmi vahetus

Platvormi ettevalmistamine

Platvorm koosneb

• Debian v. 12 operatsioonisüsteem
• Docker Community Edition
• PostgreSQL v. 12
• NginX

PostgreSQL

root@pdns:/tmp# apt-get install postgresql-common
root@pdns:/tmp# mkdir /etc/postgresql-common/createcluster.d
root@pdns:/tmp# echo "initdb_options = '--data-checksums'" > /etc/postgresql-common/createcluster.d/moraal.conf
root@pdns:/tmp# echo "create_main_cluster = false" >> /etc/postgresql-common/createcluster.d/moraal.conf
root@pdns:/tmp# apt-get install postgresql-16
root@pdns:/tmp# pg_createcluster --locale en_US.UTF-8 16 pgcluster_pdns_prod
 
postgres=# \x
Expanded display is on.
postgres=# \l postgres
List of databases
-[ RECORD 1 ]-----+------------
Name              | postgres
Owner             | postgres
Encoding          | UTF8
Locale Provider   | libc
Collate           | en_US.UTF-8
Ctype             | en_US.UTF-8
ICU Locale        | 
ICU Rules         | 
Access privileges | 

PowerDNS kasutaja ja create database baasi tekitamiseks sobib öelda

# su - postgres
$ psql
sql> create role pdns login;
sql> \password pdns
sql> create database db_pdns owner = pdns;

PowerDNS-Admin kasutaja ja create database baasi tekitamiseks sobib öelda

# su - postgres
$ psql
sql> create role pda login;
sql> \password pda
sql> create database db_pda owner = pda;

PowerDNS paigaldamine

PowerDNS ise ja tema tööks otseselt vajalikud komponendid (nt PostgreSQL andmebaas) töötavad nö tavalisel viisil operatsioonisüsteemi protsesside-teenustena st mitte-konteineritena.

# apt-get install pdns-server pdns-backend-pgsql pdns-tools

Tulemusena käivitatakse pdns server ja tema bind backend.

TODO

PostgreSQL backend kasutamine

# psql -h 127.0.0.1 -U pdns pdns < /usr/share/doc/pdns-backend-pgsql/schema.pgsql.sql
Password for user pdns: 
CREATE TABLE
CREATE INDEX
CREATE INDEX
CREATE TABLE
CREATE INDEX
...

Baasi ligipääs jms kirjeldatakse failis, https://doc.powerdns.com/authoritative/backends/generic-postgresql.html#

root@pdns:~# egrep -v "^#|^$" /etc/powerdns/pdns.d/gpgsql.conf
launch+=gpgsql
gpgsql-dbname=db_pdns
gpgsql-dnssec=yes
gpgsql-host=127.0.0.1
gpgsql-password=parool
gpgsql-port=5432
gpgsql-user=pdns

bind eemaldamiseks sobib kustutada fail

# rm /etc/powerdns/pdns.d/bind.conf

Tulemusena töötab pdns server, gpgsql backendiga

2024-06-16T16:44:00.877817+03:00 pdns systemd[1]: Starting pdns.service - PowerDNS Authoritative Server...
2024-06-16T16:44:00.906026+03:00 pdns pdns_server[3916]: Loading '/usr/lib/x86_64-linux-gnu/pdns/libgpgsqlbackend.so'
2024-06-16T16:44:00.906356+03:00 pdns pdns_server[3916]: This is a standalone pdns
2024-06-16T16:44:00.906408+03:00 pdns pdns_server[3916]: Listening on controlsocket in '/run/pdns/pdns.controlsocket'
2024-06-16T16:44:00.906668+03:00 pdns pdns_server[3916]: UDP server bound to 0.0.0.0:53
2024-06-16T16:44:00.906684+03:00 pdns pdns_server[3916]: UDP server bound to [::]:53
2024-06-16T16:44:00.906735+03:00 pdns pdns_server[3916]: TCP server bound to 0.0.0.0:53
2024-06-16T16:44:00.906750+03:00 pdns pdns_server[3916]: TCP server bound to [::]:53
2024-06-16T16:44:00.906866+03:00 pdns pdns_server[3916]: PowerDNS Authoritative Server 4.9.1 (C) PowerDNS.COM BV
2024-06-16T16:44:00.906881+03:00 pdns pdns_server[3916]: Using 64-bits mode. Built using gcc 12.2.0 on May 28 2024 07:46:05 by root@localhost.
2024-06-16T16:44:00.906891+03:00 pdns pdns_server[3916]: PowerDNS comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it according to the terms of the GPL version 2.
2024-06-16T16:44:00.915255+03:00 pdns pdns_server[3916]: Polled security status of version 4.9.1 at startup, no known issues reported: OK
2024-06-16T16:44:00.926644+03:00 pdns pdns_server[3916]: Creating backend connection for TCP
2024-06-16T16:44:00.935773+03:00 pdns pdns_server[3916]: About to create 3 backend threads for UDP
2024-06-16T16:44:00.935850+03:00 pdns systemd[1]: Started pdns.service - PowerDNS Authoritative Server.
2024-06-16T16:44:01.086206+03:00 pdns pdns_server[3916]: Done launching threads, ready to distribute questions

ühtegi tsooni ei ole kirjeldatud

root@pdns:/tmp# pdnsutil list-all-zones
root@pdns:/tmp# 

PowerDNS seadistamine

Seadistamisel tegeldakse

• api sisselülitamine (PDA jaoks)
• SOA kirje vaikeväärtused
• DNSSEC vaike krüpto

PowerDNS-Admin paigaldamine - PDA - docker

PowerDNS-Admin tarvkara töötab docker konteinerina, aga kasutab host arvutist postgresql andmebaasi. Platvorm ettevalmistamine punktis on vajalik kasutaja ja create database tekitatud. PDA kasutamine eeldab, et PDNS juures on sisse lülitatud api liides (vaikimisi http liiklus üle port 8081).

Docker compose fail

root@pdns:~# cat docker-compose-pda.yml
services:
  svc_pda:
    image: powerdnsadmin/pda-legacy:v0.4.2
     
    container_name: cn_pda
    restart: always
    logging:
      driver: json-file
      options:
        max-size: 50m
    ports:
      - "9191:80"
    environment:
      - SECRET_KEY='saladus'
      - SQLALCHEMY_DATABASE_URI=postgresql://pda:pdaparool@192.168.10.53/pda
      - GUNICORN_TIMEOUT=60
      - GUNICORN_WORKERS=2
      - GUNICORN_LOGLEVEL=DEBUG
      - OFFLINE_MODE=False
      - CSRF_COOKIE_SECURE=False
 
    networks:
      - nw_pda
       
networks:
  nw_pda:
    name: nw_pda
    driver: bridge

Käivitamiseks

# docker compose -f docker-compose-pda.yml up -d

Tulemusena on aadressil http://192.168.10.53:9191/ PDA webgui sisselogimise ekraan. Pressida Create Account ja esimesena tekitatud kasutaja on admin privileegidega.

TODO

PowerDNS-Admin paigaldamine - NginX operatsioonisüsteem

NginX https:// frontend kasutamiseks sobib kasutada sellist seadistust

root@pdns:/etc/nginx/sites-enabled# cat /etc/nginx/sites-enabled/pdns 
server {
    listen 80;
    server_name pdns.moraal.ee;
    root /var/www/html;
 
    if ($request_uri !~ /.well-known) {
      return 301 https://pdns.moraal.ee/;
    }
}
 
server {
    listen 443 ssl http2;
    server_name pdns.moraal.ee;
    ssl_certificate /etc/ssl/localcerts/pdns.moraal.ee.pem;
    ssl_certificate_key /etc/ssl/localcerts/pdns.moraal.ee.key;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
 
    client_max_body_size 25m;
 
    ssl_stapling off;
    add_header Strict-Transport-Security "max-age=63072000" always;
 
    access_log /var/log/nginx/access-pdns.moraal.ee-443.log;
    root /var/www/html;
 
    location / {
      proxy_set_header Host $http_host;
      proxy_set_header X-Forwarded-For $remote_addr;
      proxy_set_header X-Forwarded-Proto https;
      proxy_pass http://192.168.10.53:9191;
    }
}

PowerDNS-Admin paigaldamine - NginX docker

# cat /srv/pdns/volume/nginx/etc/nginx/nginx.conf
# nginx.conf

user nginx;
worker_processes auto;
error_log /dev/stderr;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log /dev/stdout main;

    sendfile        on;
    keepalive_timeout  65;

    # Redirect HTTP to HTTPS
    server {
        listen 80;
        server_name _;
        return 301 https://$host$request_uri;
    }

    # HTTPS Configuration
    server {
        listen 443 ssl;
        server_name _;
        http2 on;
        ssl_protocols TLSv1.3;
        ssl_prefer_server_ciphers on;

        ssl_certificate /etc/ssl/localcerts/ns-pdns-01.auul.pri.ee.crt;
        ssl_certificate_key /etc/ssl/localcerts/ns-pdns-01.auul.pri.ee.key;

        # Recommended security settings
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305;

        # Logging
        access_log /dev/stdout;
        error_log /dev/stdout;

        # Reverse proxy to the destination
        location / {
            proxy_pass http://svc_pdns:8081;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}

Misc

Tulemusena saab pda webgui poole pöörduda aadressiga https://pdns.moraal.ee/.

PDA kasutaja parooli muutmine postgresql baasis, nb rakendus kasutab tabeli nimena 'user', see on postgresql nö built-in objekt ja name clash ületamiseks tuleb pöörduda rakendusega seotud ressursi poole "user" abil, eriti koos skeemi prefiksiga

# su - postgres
$ psql db_pda
pda=# select * from public."user";
-[ RECORD 1 ]------------------------------------------------------------
id         | 1
username   | admin
password   | $2y$15$NgdA4JSsKb1RyaiWBdKjcODfgxkwmhMB.95sa07PX/d9a9QxZ/4FF
firstname  | Imre
lastname   | Oolberg
email      | imre.oolberg@auul.pri.ee
otp_secret | 
role_id    | 1
confirmed  | f
..

db_pda=# update public."user" set password='$2y$15$NgdA4JSsKb1RyaiWBdKjcODfgxkwmhMB.95sa07PX/d9a9QxZ/4FC' where username='admin';
UPDATE 1

kusjuures password väärtus tekitatakse nt

$ htpasswd -bnBC 15 "" pdaparool | tr -d ':\n'
$2y$15$NgdA4JSsKb1RyaiWBdKjcODfgxkwmhMB.95sa07PX/d9a9QxZ/4FC

Kasutaja lisamine

db_pda=# insert into "user" (username, password, firstname, lastname, email, role_id, confirmed) values ('admin',  '$2b$12$4M9qXQaWn95GTregvSO2v.I/1QQT0/Ayqt3jZsMp06FIa5dMme6Gu', 'Administrator', 'Administrator', 'priit@moraal.ee', 1, 'f');

pdns api kontakti lisamine

db_pda=# insert into setting (name, value) values ('pdns_api_url', 'http://192.168.10.80:8081');
INSERT 0 1
db_pda=# insert into setting (name, value) values ('pdns_api_key', 'apiparool');
INSERT 0 1
db_pda=# insert into setting (name, value) values ('pdns_version', '4.9.11');
INSERT 0 1
db_pda=# select * from setting;
 id |     name     |         value
----+--------------+------------------------
  7 | pdns_api_url | http://192.168.10.80:8081
  8 | pdns_api_key | apiparool
  9 | pdns_version | 4.9.11
(3 rows)

PDA kasutamise privileegid

Väited

• Account - grupi taoline moodustis, praktiliselt võiks vastata domeeni omanik asutusele
• User - kasutaja taoline moodustis, vastab inimesele kes süsteemi kasutab
• User ja Account vaheliste seoste abil saab anda hulgale kasutajatele õiguse tegeleda hulga domeenidega

root@rv-xxx-01:/opt/pda/dc# docker exec -ti e8 sh
/app $ ps aux
PID   USER     TIME  COMMAND
    1 pda       0:00 {gunicorn} /usr/bin/python3 /usr/bin/gunicorn powerdnsadmin:create_app() -t 60 --workers 2 --bind 0.0.0.0:80 --log-level DEBUG
    7 pda       0:02 {gunicorn} /usr/bin/python3 /usr/bin/gunicorn powerdnsadmin:create_app() -t 60 --workers 2 --bind 0.0.0.0:80 --log-level DEBUG
    8 pda       0:01 {gunicorn} /usr/bin/python3 /usr/bin/gunicorn powerdnsadmin:create_app() -t 60 --workers 2 --bind 0.0.0.0:80 --log-level DEBUG

[2025-10-31 13:06:25,927] [record.py:61] ERROR - Cannot fetch zone's record data from remote powerdns api. DETAIL: HTTPSConnectionPool(host='rvxxx-01.test.moraal.ee', port=443): Max retries exceeded with url: /api/v1/servers/localhost/zones/imretest-03.ee (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1007)')))

    volumes:
        #      - /opt/pda/volume/pda/etc/ssl/certs/ca-certificates.crt:/usr/lib/python3.10/site-packages/certifi/cacert.pem

PDA API liidese kasutamine

Tsooni tekitamine

$ curl -s -L -H 'Content-Type: application/json' -H 'Authorization: Basic xxx' -X POST https://pda.moraal.ee/api/v1/pdnsadmin/zones \
    --data '{"name": "zone-moraal-imre-test-01.ee.", "kind": "MASTER", "nameservers": ["ans1.moraal.ee.", "ans2.moraal.ee."]}' | jq .
{
  "account": "",
  "api_rectify": false,
  "catalog": "",
  "dnssec": false,
  "edited_serial": 2026010802,
  "id": "zone-moraal-imre-test-01.ee.",
  "kind": "Master",
  "last_check": 0,
  "master_tsig_key_ids": [],
  "masters": [],
  "name": "zone-moraal-imre-test-01.ee.",
  "notified_serial": 0,
  "nsec3narrow": false,
  "nsec3param": "",
  "rrsets": [
    {
      "comments": [],
      "name": "zone-moraal-imre-test-01.ee.",
      "records": [
        {
          "content": "ans1.moraal.ee. hostmaster.moraal.ee. 2026010801 86400 7200 2419200 10800",
          "disabled": false
        }
      ],
      "ttl": 3600,
      "type": "SOA"
    },
    {
      "comments": [],
      "name": "zone-moraal-imre-test-01.ee.",
      "records": [
        {
          "content": "ans1.moraal.ee.",
          "disabled": false
        },
        {
          "content": "ans2.moraal.ee.",
          "disabled": false
        }
      ],
      "ttl": 3600,
      "type": "NS"
    }
  ],
  "serial": 2026010801,
  "slave_tsig_key_ids": [],
  "soa_edit": "",
  "soa_edit_api": "DEFAULT",
  "url": "/api/v1/servers/localhost/zones/zone-moraal-imre-test-01.ee."
}

Kui pole ligipääsu saab sellise vastuse

% curl -s -L -H 'Content-Type: application/json' -H 'X-API-KEY:  xxx' -X GET "https://pda.moraal.ee/api/v1/servers/localhost/zones/zone-moraal-imre-test-01.ee" | jq .
{
  "msg": "Zone access not allowed"
}

pdns docker lahendus

# egrep -v "^$|^#" /etc/powerdns/pdns.conf
allow-axfr-ips=127.0.0.1,192.168.10.0/24
allow-notify-from=
allow-unsigned-notify=yes
also-notify=
api=yes
api-key=saladus
default-api-rectify=yes
default-ksk-algorithm=ecdsa256
default-soa-content=ans1.auu.pri.ee hostmaster.auul.pri.ee 0 86400 7200 2419200 10800
default-soa-edit=INCEPTION-INCREMENT
default-soa-edit-signed=INCEPTION-INCREMENT
default-ttl=3600
disable-syslog=no
forward-notify=
include-dir=/etc/powerdns/pdns.d
launch=
local-address=172.30.0.15, 10.30.0.15
local-port=53
log-dns-details=yes
log-dns-queries=yes
log-timestamp=yes
loglevel=4
only-notify=
primary=yes
secondary=yes
webserver=yes
webserver-address=10.30.0.15
webserver-allow-from=0.0.0.0/0
webserver-loglevel=detailed
webserver-password=saladus
webserver-port=8081

pdns podman lahendus

PDNS Quadlet Service kirjeldus

kasutaja@ns-pdns-01:~$ cat .config/containers/systemd/pdns-01.container
[Unit]
Description=My PDNS Quadlet Service
DefaultDependencies=no
After=network.target

[Container]
Image=docker.io/powerdns/pdns-auth-49:latest
PublishPort=1053:8053/tcp
PublishPort=1053:8053/udp
ContainerName=pdns-01
Volume=%h/volume/pdns/etc/powerdns/pdns.conf:/etc/powerdns/pdns.conf:ro
Environment=PDNS_local_port=8053

[Install]
# This tells systemd to start it when you log in
WantedBy=default.target

ning pdns.conf seadistusfail

# cat /opt/pdns/volume/pdns/etc/powerdns/pdns.conf
local-address=0.0.0.0
launch=
# include-dir=/etc/powerdns/pdns.d
api=yes
api-key=parool
webserver=yes
webserver-address=0.0.0.0
webserver-allow-from=0.0.0.0/0

#master=yes

primary=yes
secondary=yes
allow-axfr-ips= 100.20.21.0/24,127.0.0.1/32,172.17.0.0/16
also-notify=192.168.1.150
only-notify=
forward-notify=
default-soa-content=ans1.auul.pri.ee hostmaster.auul.pri.ee 0 86400 7200 2419200 10800
default-soa-edit=INCEPTION-INCREMENT
default-soa-edit-signed=INCEPTION-INCREMENT
default-ttl=3600

default-ksk-algorithm=ecdsa256
default-api-rectify=yes
# default-nsec3-param=1 0 0 -

launch+=gpgsql
gpgsql-dnssec=yes
gpgsql-extra-connection-parameters=password=parool dbname=db_pdns port=5432 user=pdns host=192.168.1.147