Pdns: Add SSL support to the API

[BrightSkyz]

• Program: Authoritative
• Issue type: Feature request

Short description

Allow to add an optional SSL certificate to the webserver.

Usecase

Add SSL support for the webserver so people that have to run a panel, etc. on another server are able to encrypt their traffic with SSL.

Description

This will add a few options to the PowerDNS configuration that would be used to configure SSL on the webserver.

# Enable SSL support on the webserver
# Ex. yes, no
ssl-webserver=no

# SSL certificate for the webserver
# Ex. /path/to/certificate.crt
ssl-certificate=

# SSL private key for the webserver
# Ex. /path/to/private-key.pem
ssl-private-key=

# Optional: Make SSL run on a separate port (no for the same port as the non-SSL webserver)
# Ex. no, 8082, any available port
ssl-port=no

# Force redirect to SSL on the webserver from non-SSL
# Ex. yes, no
ssl-required=yes

# The redirect code used for redirecting to SSL if it it required
# Ex. 301, 302, 303
ssl-redirect-type=302

[hlindqvist]

I think it's worth considering that another option is placing some readily available reverse-proxy (eg nginx) in front of the current pdns API.

[BrightSkyz]

Doing so with a Nginx in front of the dashboard does two things:

1. Adds more time when querying/using the API.
2. Some setup's don't make sense for using Nginx. (Browser -> Nginx reverse proxy -> Backend Nginx -> PowerDNS web-server)

[bjoe2k4]

1. rather insignificant
2. not sure what you mean? Usually it is like this User->nginx->pdns webserver. No need for a second nginx server.

[hlindqvist]

@bjoe2k4 However, with the authentication mode of the pdns api (single API key with full access), its "user" would typically have to be some fully trusted application rather than the user.
Ie, I imagine it would be user -> yourapp -> https-capable-reverse-proxy -> pdns api (if "yourapp" and pdns-api are on different hosts and you want to secure the traffic between them).

OR, if you want to let actual users make API calls, you'd probably need some authentication proxy (which can give users access to only specific zones, possibly just filtering by request path) in front.
Ie, user -> authentication proxy -> pdns api (or user -> https-capable-reverse-proxy -> authentication proxy -> pdns api as it may be).

[BrightSkyz]

Basically what I was able to interpret what @hlindqvist said, (which I think was what I was saying) is the traffic between Nginx and the pdns api isn't secure. Think of it as the ~trash~ CloudFlare flexible SSL, traffic between you and CloudFlare is secure, but CloudFlare and your server isn't secure.

# CloudFlare Flexible SSL:
User (SSL) -> CloudFlare (SSL) -> SSL Terminated -> Webserver (Non-SSL)

# What you can do right now with Nginx:
User (SSL) -> Nginx (SSL) -> SSL Terminated -> PDNS API (Non-SSL)

# If you put a Nginx on the PDNS API server also:
User (SSL) -> Nginx (SSL) -> *insert more request time here* -> Nginx on PDNS API (SSL) -> SSL Terminated -> PDNS API (Non-SSL)

The problem would be traffic between the Nginx and pdns API isn't secure, and for people like me who run all the traffic through Nginx proxies, it wouldn't be good to run traffic through a second Nginx proxy on the server with the pdns API - which would add time to the request.

[rgacogne]

Given the complexity that it would add to the existing API code (and the increase in surface attack) and how easy it is to run something like HAproxy or nginx on the same host as the PowerDNS server to offload TLS, my personal opinion is that it's currently unlikely that we will implement this.

[Habbie]

Indeed. We are not doing this. Closing ticket, sorry!

[BrightSkyz]

@rgacogne The reason why I said this is to add SSL support to the actual API not use Nginx or HAproxy as using one makes load times increase and directly connecting doesn't.

[rgacogne]

I'm sure it's negligible in almost all cases, and the code complexity increase wouldn't be.

[ghost]

The technically correct solution is to add TLS support although in many cases the performance decrease due a proxy workaround wouldn't be noticeable.

[paulhermanseu]

I wrote a blog post how to configure SSL for the PowerDNS api using Nginx, see here: https://dnssec-script.com/configuring-ssl-for-powerdns-api/

[Habbie]

Hi Paul,

people don't tend to notice comments on closed issues. I created a new wiki page and linked it there: https://github.com/PowerDNS/pdns/wiki/Howto-articles