1
0
mirror of https://github.com/mail-in-a-box/mailinabox.git synced 2024-12-22 07:17:05 +00:00
mailinabox/management
Joshua Tauberer 178c587654 Migrate to the ECDSAP256SHA256 (13) DNSSEC algorithm
* Stop generating RSASHA1-NSEC3-SHA1 keys on new installs since it is no longer recommended, but preserve the key on existing installs so that we continue to sign zones with existing keys to retain the chain of trust with existing DS records.
* Start generating ECDSAP256SHA256 keys during setup, the current best practice (in addition to RSASHA256 which is also ok). See https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtml#dns-sec-alg-numbers-1 and https://www.cloudflare.com/dns/dnssec/ecdsa-and-dnssec/.
* Sign zones using all available keys rather than choosing just one based on the TLD to enable rotation/migration to the new key and to give the user some options since not every registrar/TLD supports every algorithm.
* Allow a user to drop a key from signing specific domains using DOMAINS= in our key configuration file. Signing the zones with extraneous keys may increase the size of DNS responses, which isn't ideal, although I don't know if this is a problem in practice. (Although a user can delete the RSASHA1-NSEC3-SHA1 key file, the other keys will be re-generated on upgrade.)
* When generating zonefiles, add a hash of all of the DNSSEC signing keys so that when the keys change the zone is definitely regenerated and re-signed.
* In status checks, if DNSSEC is not active (or not valid), offer to use all of the keys that have been generated (for RSASHA1-NSEC3-SHA1 on existing installs, RSASHA256, and now ECDSAP256SHA256) with all digest types, since not all registers support everything, but list them in an order that guides users to the best practice.
* In status checks, if the deployed DS record doesn't use a ECDSAP256SHA256 key, prompt the user to update their DS record.
* In status checks, if multiple DS records are set, only fail if none are valid. If some use ECDSAP256SHA256 and some don't, remind the user to delete the DS records that don't.
* Don't fail if the DS record uses the SHA384 digest (by pre-generating a DS record with that digest type) but don't recommend it because it is not in the IANA mandatory list yet (https://www.iana.org/assignments/ds-rr-types/ds-rr-types.xhtml).

See #1953
2021-04-12 19:42:12 -04:00
..
templates Sort the Custom DNS by zone and qname, and add an option to go back to the old sort order (creation order) 2021-02-28 09:40:32 -05:00
auth.py Exclude mru_token in user key hash 2020-09-30 12:34:26 +02:00
backup.py Implement Backblaze for Backup (#1812) 2020-11-26 07:13:31 -05:00
cli.py Add MFA list/disable to the management CLI so admins can restore access if MFA device is lost 2020-10-31 10:23:43 -04:00
csr_country_codes.tsv drop the CSR_COUNTRY setting and ask within the control panel 2015-12-26 11:48:23 -05:00
daemon.py Sort the Custom DNS by zone and qname, and add an option to go back to the old sort order (creation order) 2021-02-28 09:40:32 -05:00
daily_tasks.sh daily_tasks.sh: redirect stderr to stdout (#1768) 2020-06-07 09:56:45 -04:00
dns_update.py Migrate to the ECDSAP256SHA256 (13) DNSSEC algorithm 2021-04-12 19:42:12 -04:00
email_administrator.py send the mail_log.py report to the box admin every Monday 2018-02-25 11:55:06 -05:00
mail_log.py Fixed #1894 log date over year change, START_DATE < END_DATE now. (#1905) 2021-02-28 07:59:26 -05:00
mailconfig.py Reorganize the MFA backend methods 2020-09-26 09:58:25 -04:00
mfa.py Add MFA list/disable to the management CLI so admins can restore access if MFA device is lost 2020-10-31 10:23:43 -04:00
munin_start.sh update bind9 configuration 2018-10-03 14:28:43 -04:00
ssl_certificates.py Display certificate expiry dates in ISO format (#1841) 2020-10-16 16:22:36 -04:00
status_checks.py Migrate to the ECDSAP256SHA256 (13) DNSSEC algorithm 2021-04-12 19:42:12 -04:00
utils.py move the custom exclusive process code from utils.py into a new python package named exclusiveprocess 2017-01-15 11:02:23 -05:00
web_update.py Use tabs instead of spaces in nginx conf (#1827) 2020-09-27 07:13:33 -04:00