RSASHA1 Should Not Be Used For Zone Signing

More Info:

Ensure that RSASHA1 is not used for the zone-signing key in Cloud DNS DNSSEC.

Risk Level

Medium

Address

Security

Compliance Standards

CIS GCP
CIS GCP 2.0.0
Cloudanix Best Practice

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the "RSASHA1 Should Not Be Used For Zone Signing" misconfiguration for GCP using GCP console, you can follow the below steps:

Open the Google Cloud Console and select the project where the zone is located.
In the navigation menu, select "Network services" and then "Cloud DNS".
Select the DNS zone for which you want to remediate the misconfiguration.
In the "DNSSEC" tab, check the status of your DNSSEC configuration. If it is not enabled, enable it by clicking on "Enable DNSSEC".
Once DNSSEC is enabled, click on "Manage Keys" to view the keys used for signing the zone.
Check if the key algorithm is set to "RSASHA1". If it is, then you need to create a new key with a stronger algorithm.
To create a new key, click on "Add Key" and select a stronger algorithm like "RSASHA256" or "ECDSAP256SHA256".
Once the new key is created, set it as the active key by clicking on the "Set Active" button next to it.
Finally, re-sign the zone by clicking on "Re-sign Zone". This will ensure that the new key is used for signing the zone and the RSASHA1 algorithm is no longer used.

By following these steps, you can remediate the "RSASHA1 Should Not Be Used For Zone Signing" misconfiguration for GCP using GCP console.

Using CLI

To remediate the "RSASHA1 Should Not Be Used For Zone Signing" misconfiguration in GCP using GCP CLI, you can follow the steps below:

Open the Cloud Shell in GCP Console.
Run the following command to list all the managed zones in your project:
```
gcloud dns managed-zones list
```
Choose the managed zone that you want to update and note down its name.
Run the following command to update the DNSSEC algorithm for the chosen managed zone:
```
gcloud dns managed-zones update [MANAGED_ZONE_NAME] --dnssec-algorithm=RSASHA256
```
Note: Replace [MANAGED_ZONE_NAME] with the name of the managed zone that you want to update.
Verify that the DNSSEC algorithm has been updated successfully by running the following command:
```
gcloud dns managed-zones describe [MANAGED_ZONE_NAME] --format="value(dnssecConfig.defaultKeySpecs[0].algorithm)"
```
Note: Replace [MANAGED_ZONE_NAME] with the name of the managed zone that you updated in Step 4.

The output of this command should be "RSASHA256", which indicates that the DNSSEC algorithm has been updated successfully.
Repeat Steps 4 and 5 for all the managed zones in your project.

By following these steps, you can remediate the "RSASHA1 Should Not Be Used For Zone Signing" misconfiguration in GCP using GCP CLI.

Using Python

To remediate the "RSASHA1 Should Not Be Used For Zone Signing" issue for GCP using Python, you can follow the below steps:

First, you need to authenticate to GCP using the Google Cloud SDK and set up a project.
Next, you need to install the Google Cloud DNS API client library for Python using the following command:
```
pip install google-cloud-dns
```
Once the library is installed, you can write a Python script to retrieve the DNS zone for which you want to remediate the issue. You can use the following code snippet:
```
from google.cloud import dns

# Authenticate to GCP
client = dns.Client()

# Retrieve the DNS zone
zone_name = 'example.com.'
zone = client.zone(zone_name)
```
Once you have retrieved the DNS zone, you can update the zone signing algorithm to use a more secure algorithm. You can use the following code snippet to update the zone signing algorithm to RSASHA256:
```
from google.cloud.dns import record

# Update the zone signing algorithm
zone.dnssec_config.default_key_spec = record.RSASHA256
zone.update()
```

Finally, you can verify that the zone signing algorithm has been updated by retrieving the DNS zone and checking the default key specification:

# Retrieve the DNS zone
zone = client.zone(zone_name)

# Check the default key specification
default_key_spec = zone.dnssec_config.default_key_spec
print(f'Default key specification: {default_key_spec}')

By following these steps, you can remediate the "RSASHA1 Should Not Be Used For Zone Signing" issue for GCP using Python.

Using Terraform

resource "google_dns_managed_zone" "DNS_ZONE" {
  name        = "DNS_ZONE_NAME"          # e.g. "prod-example-com"
  dns_name    = "DNS_NAME."              # e.g. "example.com."
  description = "DESCRIPTION_OF_ZONE"

  # Ensure DNSSEC is enabled and does NOT use RSASHA1 for the zone-signing key
  dnssec_config {
    state = "on"

    default_key_specs {
      key_type  = "KEY_SIGNING"
      algorithm = "rsasha256"            # or "ecdsap256sha256", but NOT "rsasha1"
      key_length = 2048
    }

    default_key_specs {
      key_type  = "ZONE_SIGNING"
      algorithm = "rsasha256"            # or "ecdsap256sha256", but NOT "rsasha1"
      key_length = 1024
    }
  }
}

Substitute:

DNS_ZONE with your Terraform resource name.
DNS_ZONE_NAME with the managed zone name in Cloud DNS.
DNS_NAME with the DNS suffix for the zone.
DESCRIPTION_OF_ZONE with a suitable description.

This change updates the DNSSEC configuration in-place (no managed zone replacement) to use a stronger algorithm for the zone-signing key. After editing, terraform plan should show an in-place update to the dnssec_config.default_key_specs algorithm values from rsasha1 to rsasha256 (or your chosen non-RSASHA1 algorithm), with no -/+ replacement of the google_dns_managed_zone resource.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​