--- title: "Configuring GSS-TSIG keys" canonical: "https://docs.infoblox.com/space/nios85/35418140/Configuring%20GSS-TSIG%20keys" format: markdown --- You can upload keytab files that contain a single GSS-TSIG key or multiple GSS-TSIG keys on a single NIOS appliance. For each member in the Grid, you can upload up to 256 GSS-TSIG keys in a single keytab file. Trust relationships between AD domains and AD forests are not required. You can upload GSS-TSIG keys through Grid Manager or the Infoblox API. Note that only superusers can manage all GSS-TSIG keys globally on a given member through Grid Manager or the Infoblox API. Using this feature, superusers can determine the keys that belong to a particular member. You can assign multiple GSS-TSIG keys to a member and all these keys are saved in the Grid. The uploaded keys will be available in the member DNS, Grid DNS, member DHCP or Grid DHCP properties. NIOS supports the following GSS-TSIG encryption types: - des-cbc-crc - des-cbc-md5 - arcfour-hmac-md5 - aes128-cts-hmac-sha1-96 - aes256-cts-hmac-sha1-96 NIOS displays a warning message in Grid Manager and in the syslog if you upload a key that does not belong to the GSS-TSIG encryption types. For more information, see *[Logging](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[Messages](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*. # > Macro (anchor) > Macro (anchor) Limitations when Using Multiple GSS-TSIG keys - You can assign SPNs belonging to different domains to a DNS member, but you cannot assign SPNs belonging to different domains to a DHCP member, although two DHCP members can update the same DNS member. - You must ensure that the domains assigned to a DNS member are unique. - The GSS-TSIG domain for a remote forward or remote reverse zone is single-valued. For example, if DHCP clients ABC and XYZ from Grid 1 want to send DDNS updates to Grid 2, either client ABC or XYZ will succeed. # > Macro (anchor) > Macro (anchor) Scheduled Upgrade A scheduled upgrade with one or more keys in the keytab files that you have uploaded will operate the same as prior to upgrade. NIOS will parse and extract keys from the uploaded keytab file. NIOS automatically assigns these keys to the DNS member, DHCP member, Grid DHCP or Grid DNS to which the keytab file was uploaded before the upgrade. You can assign these keys to Grid members after the upgrade is complete. NIOS does not display an error message if the keys do not have an SPN with the DNS prefix, but it will record a warning message in the syslog. # > Macro (anchor) > Macro (anchor) > Macro (anchor) Admin Permissions for Configuring GSS-TSIG keys You can assign a key to a Grid member only if you have read permission for the kerberos key and read/write permission for the member. You can upload keys only if you have read/write permissions for kerberos keys. To remove a key that is assigned to a member, you must have read/write permission for the respective member. Note that in the **Administration** -> **Administrators** -> **Permissions** tab, NIOS displays **All** **Kerberos** **Keys** and **Kerberos** **Key** in the **Resource** and **Resource** **Type** columns respectively for **DHCP** **Admin** and **DNS** **Admin** roles with default read/write permissions. # > Macro (anchor) > Macro (anchor) Enabling GSS-TSIG Authentication for DHCP You can enable GSS-TSIG authentication at the Grid or member level and associate it with one or more keys of the same SPN or realm. When you enable GSS-TSIG authentication, make sure that you upload the keytab file from the Kerberos account for the Infoblox DHCP server. You can import keytab files with multiple keys to the Grid or to individual members. You can assign the uploaded keys to member DHCP or Grid DHCP. The appliance displays a warning message if you assign a GSS-TSIG key with service class "DNS" in its SPN to a DHCP member. The appliance displays an error message in the following cases: - if you assign keys of different realms to a DHCP member or Grid DHCP. - when you try to enable GSS-TSIG without a valid key. The AD domain controller stores the keytab file in the directory in which you generated the keytab file. You can copy this file to a management system that connects to the NIOS appliance or launch the NIOS Grid Manager on the AD domain controller and import the keytab file to the NIOS appliance. To enable GSS-TSIG authentication for DHCP and import keytab files: 1. **Grid:** From the **Data** **Management** tab, select the **DHCP** tab, expand the Toolbar and click **Grid** **DHCP** **Properties**.  **Member**: From the **Data** **Management** tab, select the **DHCP** tab and click the **Members** tab -> *member* checkbox -> Edit icon. To override an inherited property, click **Override** next to it and complete the appropriate fields. **Standalone** **DHCP:** From the **Data** **Management** tab, select the **DHCP** tab, expand the Toolbar and click **System** **DHCP** **Properties**. 2. In the **IPv4** **DDNS** -> **Basic** tab or the **IPv6** **DDNS** -> **Basic** tab of the editor, complete the following: - **DDNS** **Updates:** Select **Enable** **DDNS** **Updates** to enable the DHCP servers in the Grid to send DDNS updates. - **DDNS** **Domain** **Name**: Specify the domain name of the network that the appliance uses to update DNS. For IPv4 clients, you can specify this at the network, network template, range, and range template levels. For IPv6 clients, you can specify this at the Grid, member, network, shared network, and network template levels. - **DDNS** **Update** **TTL**: You can set the TTL used for A record and PTR records updated by the DHCP server. The default is shown as zero. If you do not enter a value here, the appliance by default sets the TTL to half of the DHCP lease time with a maximum of 3600 seconds. For example, a lease time of 1800 seconds results in a TTL of 900 seconds, and a lease time of 86400 seconds results in a TTL of 3600 seconds. - **DDNS** **Update** **Method**: Select the method used by the DHCP server to send DDNS updates. You can select either **Interim** or **Standard** from the drop-down list. The default is **Interim**. When you select **Interim**, TXT record will be created for DDNS updates and when you select **Standard**, DHCID record will be created for DDNS updates. But in the **IPv4** **DDNS** -> **Advanced** tab or the **IPv6** **DDNS** -> **Advanced** tab, if you have selected **No** **TXT** **Record** mode for the DHCP server to use when handling DNS updates, then TXT record or DHCID record is not created for DDNS updates. If you change the DDNS update method from **Interim** to **Standard** or vice versa, then the DHCP server changes the DHCID type used from TXT record to DHCID record or vice versa as the leases are renewed. This is supported for clients that acquire both IPv4 and IPv6 leases. Infoblox recommends you to configure different DDNS update method for IPV4 leases and IPv6 leases, **Interim** for IPv4 lease and **Standard** for IPv6 lease. - **GSS-TSIG**: Complete the following: > Macro (legacy-content)      3. Save the configuration and click **Restart** if it appears at the top of the screen. # > Macro (anchor) > Macro (anchor) Deleting GSS-TSIG keys associated with DHCP Objects You can delete individual keys if it is not in use by the Grid or any member. To delete a key that is assigned to a member, you must have Read/Write permission for the member. To delete individual keys: 1. **Grid:** From the **Data** **Management** tab, select the **DHCP** tab, expand the Toolbar and click **Grid** **DHCP** **Properties**.  **Member**: From the **Data** **Management** tab, select the **DHCP** tab and click the **Members** tab -> *member* checkbox -> Edit icon. **Standalone** **DHCP:** From the **Data** **Management** tab, select the **DHCP** tab, expand the Toolbar and click **System** **DHCP** **Properties**. 2. In the **IPv4** **DDNS** tab or the **IPv6** **DDNS** -> **Basic** tab of the editor, select keys from the list under **GSS-TSIG** **Keys** and click the Delete icon to delete keys. # > Macro (anchor) > Macro (anchor) Enabling GSS-TSIG Authentication for DNS For GSS-TSIG based DDNS updates, the SPN of the key used to carry out the update must have 'DNS' in its service class. You can upload a keytab file to the Grid with multiple keys in which each key has an SPN in this format:  DNS/@. You can associate a DNS member or a Grid DNS with one or more keys of the same SPN or realm or of different SPN or realms. You can assign the uploaded keys to member DNS or Grid DNS, but NIOS displays an error when you try to enable GSS-TSIG without a valid key if the assigned key does not have the service class 'DNS' in its SPN. To enable GSS-TSIG authentication for DNS and import keytab files: 1. **Grid**: From the **Data** **Management** tab, select the **DNS** tab, expand the Toolbar and click **Grid** **DNS** **Properties.** **Member**: From the **Data** **Management** tab, select the **DNS** tab and click the **Members** tab -> *member* checkbox -> Edit icon. To override an inherited property, click **Override** next to it and complete the appropriate fields. **Standalone** **DNS:** From the **Data** **Management** tab, select the **DNS** tab, expand the Toolbar and click **System** **DNS** **Properties**. 2. In the **GSS-TSIG** -> **Basic** tab of the editor, complete the following: - **GSS-TSIG:** Select **Enable** **GSS-TSIG** **authentication** **of** **clients** to accept GSS-TSIG signed DDNS updates from clients that belong to different AD domains in which each domain has an unique GSS-TSIG key. - **Manage** **Keytab** **Files**: To upload a keytab file, click **Manage** **GSS-TSIG** **keys**. In the *Manage* *GSS-TSIG* *Keys* dialog box, click the Add icon. In the *Upload* dialog box, click **Select**, navigate to the keytab file, select it, and then click **Upload**. You can also delete individual keys. For more information, see *[Managing](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[GSS-TSIG](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)* *[keys](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*. - **GSS-TSIG** **Keys**: Click the arrow beside the Add icon to either assign keys or upload and assign keys. You can either select **Assign** **Keys** or **Upload & Assign** **Keys** from the drop-down list. - **Assign** **Keys**: Select **Assign** **Keys** to select a GSS-TSIG key from the *GSS-TSIG* *Key* *Selector*. Click **Principal**, which is displayed as a hyperlink, to select it. For more information about the **GSS_TSIG** **Key** **Selector**, see *[Selecting](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[Keys](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[in](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[the](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[GSS-TSIG](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[Key](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[Selector](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*. - **Upload & Assign** **Keys**: Select **Upload & Assign** **Keys** to upload and assign keys. In the *Upload* dialog box, select the file and navigate to the file you want to upload. Click **Upload**. The appliance assigns keys in the uploaded file. The following are displayed: > Macro (legacy-content) > Macro (legacy-content)      3. Save the configuration. NIOS sorts the data in the table based on the last updated timestamp, by default. Note that sometimes GSS-TSIG updates might stop working after you restart the DNS service because the appliance discards the GSS-TSIG keys, when you restart the DNS service. If this happens, wait several minutes until the Microsoft server performs another handshake using the new key. # > Macro (anchor) > Macro (anchor) Deleting GSS-TSIG keys associated with the DNS Objects You can delete individual keys if it is not in use by the Grid or any member. To delete a key that is assigned to a member, you must have Read/Write permission for the member. To delete individual keys: 1. **Grid**: From the **Data** **Management** tab, select the **DNS** tab, expand the Toolbar and click **Grid** **DNS** **Properties.** **Member**: From the **Data** **Management** tab, select the **DNS** tab and click the **Members** tab -> *member* checkbox -> Edit icon. **Standalone** **DNS:** From the **Data** **Management** tab, select the **DNS** tab, expand the Toolbar and click **System** **DNS** **Properties**. 2. In the **GSS-TSIG** -> **Basic** tab of the editor, select keys from the list under **GSS-TSIG** **Keys**. 3. Click the Delete icon to delete. # > Macro (anchor) > Macro (anchor) Logging Messages The appliance saves the audit log entries for insert and delete operations. If you upload keys with encryption types other than the ones that NIOS supports, the appliance displays a warning message in Grid Manager and in the syslog and also it displays the encryption type as *other* in Grid Manager and in the syslog. For more information about the syslog, see [*Using a Syslog Server*](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35784616). The appliance generates an audit log when you upload a key, assign the key to a member, remove the key associated with a member or delete a key. The audit log entries are based on each key that you have uploaded. For example, NIOS saves the following in the audit log when you upload a key: `2014-02-14 18:17:30.531Z \[admin\]: imported DNS Kerberos key for` `principal='DNS/infoblox.localdomain@abc.com', version=5, enctype=des-cbc-crc` For more information about audit logs, see [*Using the Audit Log*](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35481832/Monitoring+Tools#MonitoringTools-bookmark2812). You can search Kerberos keys using the realm (domain), principal name or an encryption type. The appliance generates a comment in the option section of the DNS configuration file for each Kerberos principal that is associated with the Grid member. These comments are for information only and it indicates the principals, their versions and encryption types that are used by the appliance. # > Macro (anchor) > Macro (anchor) Managing GSS-TSIG keys You can upload a keytab file that contains one or multiple GSS-TSIG keys and delete multiple keys through the* Manage* *GSS-TSIG* *Keys* wizard. To manage multiple GSS-TSIG keys, complete the following: 1. From the **Grid** tab, select the **Grid** **Manager** tab -> **Members** tab, expand the Toolbar and click **Manage** **GSS-TSIG** **Keys.** 2. In the *Manage* *GSS-TSIG* *Keys* wizard, the following are displayed: - **Principal**: The principal name that is mapped to the keytab file. - **Domain**: The name of the domain that is mapped to the keytab file. - **Version**: The version of the keytab file. - **In** **use:** Indicates whether the keytab file is in use or not. - **Members**: The members associated with the keytab file. Click the hyperlink and the *Members* dialog box is displayed. It displays the list of members that are associated with the keytab file. - **Encryption** **type**: The encryption type of the key. - **Last** **update**: The timestamp when the key was last uploaded. 3. Click the Upload Keytab File icon to upload a new keytab file. In the *Upload* dialog box, click **Select** and navigate to the keytab file. Click **Upload** to upload the file. To delete a GSS-TSIG key, select the appropriate key and click the Delete icon. # > Macro (anchor) > Macro (anchor) Selecting Keys in the GSS-TSIG Key Selector NIOS displays the keys that you have uploaded using the keytab files. You can choose a filter and an operator to view specific keys that you have uploaded. The *GSS-TSIG* *Key* *Selector* wizard is displayed only when you select **Assign** **Keys** in the *Properties* editor. For more information about how to assign keys to DNS and DHCP objects, see *[Enabling](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)* *[GSS-TSIG](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[Authentication](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[for](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[DNS](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294) and *[Enabling](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[GSS-TSIG](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[Authentication](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[for](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[DHCP](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)*[ ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85draft/pages/26478294)respectively. To select a key from the *GSS-TSIG* *Key* *Selector*, complete the following: 1. Click **Show** **Filter** to filter the values: - Select a value from the drop-down list to filter your values: **Domain**, **Encryption** **type**, **In** **use**, **Last** **update**, **Principal**, and **Version**. - Select one of these operators from the drop-down list: **equals**, **does** **not** **equal**, **begins** **with**, and **does** **not** **begin** **with**. - Enter the value that you want to search in the text box. Click **Hide** **Filter** to hide the filter. Alternatively, you can enter a value in the text box for **Find** and click **Go** to search specific keys from the keytab files.      2. The following details are displayed in the table: > Macro (legacy-content)