What are the required steps to enable secure serverwide zone transfers between two BIND 9 servers using TSIG?

What are the required steps to enable secure serverwide zone transfers between two BIND 9 servers using TSIG?

• A. Generate a key, specify the public key on both servers.
• B. Generate a key, specify the private key on both servers.
• C. Generate a key, specify the private key on one server and the public on the other.
• D. Generate a key, specify the public key on one server and private on the other.

Answer: (B)

To enable secure serverwide zone transfers between two BIND 9 servers using TSIG (Transaction Signature), generating a key and specifying the private key on both servers is the correct procedure. In TSIG, a shared secret (the key) is used to authenticate the communication between the two servers. This key consists of both a public and a private part, but for the purpose of authentication, both servers need to use the same private key to sign the messages being sent and to validate the signatures received. By specifying the private key on both servers, you ensure that each server can generate and verify the signatures for the zone transfer requests and responses. This prevents unauthorized access and ensures that only servers that possess the correct private key can perform zone transfers, thereby enhancing the security of the DNS configuration. Setting up TSIG incorrectly by mixing the use of public and private keys between the servers would compromise the integrity of the authentication process, leading to potentially insecure zone transfers.

To enable secure serverwide zone transfers between two BIND 9 servers using TSIG (Transaction Signature), generating a key and specifying the private key on both servers is the correct procedure.

In TSIG, a shared secret (the key) is used to authenticate the communication between the two servers. This key consists of both a public and a private part, but for the purpose of authentication, both servers need to use the same private key to sign the messages being sent and to validate the signatures received.

By specifying the private key on both servers, you ensure that each server can generate and verify the signatures for the zone transfer requests and responses. This prevents unauthorized access and ensures that only servers that possess the correct private key can perform zone transfers, thereby enhancing the security of the DNS configuration.

Setting up TSIG incorrectly by mixing the use of public and private keys between the servers would compromise the integrity of the authentication process, leading to potentially insecure zone transfers.