1 % Namecoin pipe backend for PowerDNS
3 There exists a project named
4 [nmcontrol](https://github.com/namecoin/nmcontrol) to create an
5 all-in-one tool that can, among other things, act as a DNS server
6 for the `.bit` zone. There is also a tool,
7 [NamecoinToBind](https://github.com/namecoin/NamecoinToBind),
8 for offline conversion of namecoin data into BIND zone file.
10 Unlike those, this project is a single-purpose tool acting as a (real
11 time) bridge between [Namecoin](http://namecoin.info/) and DNS.
12 It is implemented as a `pipe backend` to
13 [PowerDNS](https://www.powerdns.com/), which provides stable DNS
14 frontend, and has simple backend interface.
18 The program is built as a single executable to be run by PowerDns's
19 pipe backend. It is written in [Haskell](http://www.haskell.org/).
20 There is no `cabal` configuration at the moment, so to build it,
24 ghc --make pdns-pipe-nmc
27 and install any missing packages it complains about.
31 In the powerdns configuration, you want to specify `master=yes`.
32 Enable `pipe` backend by setting `launch=pipe`.
33 Wherever your pdns package keeps the backend configurations, set
34 this for the pipe backend:
37 pipe-command=/path/to/pdns-pipe-nmc
40 pipebackend-abi-version=1 ## all versions supported, but extra data ignored
43 Copy `pdns-pipe-nmc` to the place that you've set up as `pipe-command`.
44 Copy your namecoin cofig file to `/etc/namecoin.conf` and make sure it
45 is readable by the userid specified in the powerdns config. Entries
46 recognized in the `/etc/namecoin.conf` file (with default values) are:
55 They are the parameters needed to contact the `namecoind` server over
56 its JsonRPC interface. With default installation on `localhost`, you
57 will only need to specify `rpcpassword`.
59 Configure your resolvers to use the PowerDns instance for queries in
60 the `.bit` zone. This is left as an exercise to the reader.
62 ## Security Considerations
64 Namecoin per se has excellent non-repudiation characteristics. But
65 once you've converted the data into (non-DNSSEC-protected) DNS
66 format, all bets are off. If you intend to query your powerdns
67 instance over public Internet, remember that nothing prevents evil
68 hackers or ruthless governments from tampering with your queries
69 and powerdns responses. There are two possible approaches to
70 mitigation of this problem:
72 * Run namecoind and powerdns as close to the consumer as
73 possible: on the same host, or at least on the same network, and
75 * I did not try it, but it should be possible to use PowerDNS
76 [Front-signing](http://doc.powerdns.com/html/dnssec-modes.html#dnssec-frontserver),
77 so the communication will happen over DNSSEC protocol without the
78 need to keep the signatures in the zone data itself. You probably
79 would need to create signing key for the PowerDNS instance, and add
80 the corresponding public key as "trused" into the configuration of
85 Alpha. It is largely untested, and there are loose ends in the
86 functionality. For example, `delegate` does not work yet, version in the
87 `SOA` record is bogus. Some of the the problems are due to incomplete
89 [definition of the domain data format](https://wiki.namecoin.info/index.php?title=Domain_Name_Specification)
90 on the wiki. That said, I am using it to access some of the `.bit` websites
91 and did not notice anomalies so far.
97 Check the [project homepage](http://www.average.org/pdns-pipe-nmc/).
99 Git [clone](git://git.average.org/git/pdns-pipe-nmc.git) or
100 [browse](http://www.average.org/gitweb/?p=pdns-pipe-nmc.git;a=summary),
101 or use [github mirror](https://github.com/crosser/pdns-pipe-nmc).
105 Eugene Crosser \<crosser at average dot org\>
106 <http://www.average.org/~crosser/>