Hestiacp: DKIM 2048bit key & Bind9

Created on 13 Jan 2020 · 3Comments · Source: hestiacp/hestiacp

In a few words, please describe the issue that you're experiencing:

When long (2048) DKIM keys are inserted into DNS through WebUI, bind9 fails to load the zone.

What steps did you take when the issue occurred?

Log into the Hestia Control Panel using Firefox
Go to the DNS tab
Edit DNS records and add a long DKIM key. For example I tried to add the DKIM selector sel1._domainkey with the value of
"k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4+VEVsoTbl6tYLJlhozqAGju3IgpSVdBAS5LMyzpHP8/L0/PlyVRJnm2xECjVk3DRqCmelyIvmraw1VtFz2aH6DRlDhHsZghj1DmGhwN+7NkwIb4hEvmytMVAz1WyiLH6Rm6Iemm/ZCt1RhrAMUYLxHA9mJgky76YCcf8/cX35xC+1vd4a5U6YofAZeVP9DBvVgQ8ung4gVrOrQrXkU8QfVNAoXz5pfJo74GB7woIBFhZXsU6SKho7KnzT5inVCIOtWp7L5hyEnbySWQPHT2vAMCCAe2AY/Vv0N3HW14o8P3b4A6OU920wFB2kA7pkQNzO5OwH+HSttwG0PaIiQxYQIDAQAB"
Save the changes
Then go to ssh and do: grep [domain] /var/log/syslog (replace [domain] with your domain name)
Result:
Jan 13 09:37:01 aether named[29268]: dns_rdata_fromtext: /home/[USER]/conf/dns/[DOMAIN].db:23: syntax error Jan 13 09:37:01 aether named[29268]: zone [DOMAIN]/IN: loading from master file /home/[USER]/conf/dns/[DOMAIN].db failed: syntax error Jan 13 09:37:01 aether named[29268]: zone [DOMAIN]/IN: not loaded due to errors.

Expected behavior:

Bind9 should be able to load the zone file.

Operating system distribution and release:

Ubuntu 18.04.3 LTS

Which version of Hestia Control Panel is currently installed?

VERSION='1.0.6' Installed on January 6th 2020 with the following command:
bash hst-install.sh --nginx yes --apache yes --phpfpm no --multiphp yes --named yes --vsftpd yes --proftpd no --iptables yes --fail2ban yes --quota yes --exim yes --dovecot yes --spamassassin no --clamav no --mysql yes --postgresql no --interactive yes --hostname $(hostname -f) --email [EMAIL] --password [PASSWORD] --port [PORT] --api yes

Which branch are you using?

Release

When did this issue occur? After a clean installation, or after an upgrade?

Clean installation of VERSION 1.0.6

Which of the following web server configurations are you using?

Apache + Nginx (default)
Multi-PHP

Which of the following server roles are installed on your server?

DNS
Mail (Dovecot + Exim)
Mail (Exim only)
MySQL (MariaDB)

In order to better assist, please post any relevant log information below:

Here is an excerpt of /var/log/syslog
Jan 13 09:37:01 aether named[29268]: reloading zones succeeded Jan 13 09:37:01 aether named[29268]: dns_rdata_fromtext: /home/[USER]/conf/dns/[DOMAIN].db:23: syntax error Jan 13 09:37:01 aether named[29268]: zone [DOMAIN]/IN: loading from master file /home/[USER]/conf/dns/[DOMAIN].db failed: syntax error Jan 13 09:37:01 aether named[29268]: zone [DOMAIN]/IN: not loaded due to errors. Jan 13 09:37:01 aether named[29268]: all zones loaded Jan 13 09:37:01 aether named[29268]: running

Related issues or forum threads:

I thinks this is related to the following closed issue:
https://github.com/hestiacp/hestiacp/issues/539

Additional notes:

As far as I know, bind9 can not handle records longer than 255 characters. Since a 2048 DKIM key is longer than that, it should be split in two lines, for bind9 to be able to process the zone file correctly.

If you need to create long public keys, you can use openssl genrsa 2048 | openssl rsa -pubout. Just make sure you remove the lines --BEGIN... and ---END, as well as the line breaks, before trying to add the key into a DNS record.

Please also have a look at https://github.com/serghey-rodin/vesta/issues/1551#issuecomment-569415327

bug dns

Source

ifaist0s

All 3 comments

Editing a DNS record works as expected now, unquoted values longer than 255 chars are split correctly in the bind config file.
But adding a new TXT record gets automatically quoted and bind fails to load the zone.

Temp workaround:

After adding a new TXT (>255) record go back and edit the record removing the quotes added at the beginning and the end of the value and hit save