At present, it is possible for an operator to config TSIG secrets as an argument to cascade tsig add. This is an unfortunate default we should strive to avoid, because it leaks the TSIG key to process listings and shell history. That's also the case with dig, but we have the freedom to pick a safer default.
There is already support to read the secret from a file, which still requires passing name and algorithm on the CLI.
There is no standard file format for TSIG keys that is shared amongst popular DNS implementations. The next best thing appears to be to align with our other projects. The goal of this ticket is to support our existing config format for TSIG in NSD (and soon Unbound). We can then drop support for supplying TSIG secrets on the CLI.
This issue is blocked on file parsing in Domain NLnetLabs/domain#695
At present, it is possible for an operator to config TSIG secrets as an argument to
cascade tsig add. This is an unfortunate default we should strive to avoid, because it leaks the TSIG key to process listings and shell history. That's also the case with dig, but we have the freedom to pick a safer default.There is already support to read the secret from a file, which still requires passing name and algorithm on the CLI.
There is no standard file format for TSIG keys that is shared amongst popular DNS implementations. The next best thing appears to be to align with our other projects. The goal of this ticket is to support our existing config format for TSIG in NSD (and soon Unbound). We can then drop support for supplying TSIG secrets on the CLI.
This issue is blocked on file parsing in Domain NLnetLabs/domain#695