More Info:
Ensure that RSASHA1 is not used for the zone-signing key in Cloud DNS DNSSEC.Risk Level
MediumAddress
SecurityCompliance Standards
CISGCP, CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the “RSASHA1 Should Not Be Used For Zone Signing” misconfiguration for GCP using GCP console, you can follow the below steps:
- Open the Google Cloud Console and select the project where the zone is located.
- In the navigation menu, select “Network services” and then “Cloud DNS”.
- Select the DNS zone for which you want to remediate the misconfiguration.
- In the “DNSSEC” tab, check the status of your DNSSEC configuration. If it is not enabled, enable it by clicking on “Enable DNSSEC”.
- Once DNSSEC is enabled, click on “Manage Keys” to view the keys used for signing the zone.
- Check if the key algorithm is set to “RSASHA1”. If it is, then you need to create a new key with a stronger algorithm.
- To create a new key, click on “Add Key” and select a stronger algorithm like “RSASHA256” or “ECDSAP256SHA256”.
- Once the new key is created, set it as the active key by clicking on the “Set Active” button next to it.
- Finally, re-sign the zone by clicking on “Re-sign Zone”. This will ensure that the new key is used for signing the zone and the RSASHA1 algorithm is no longer used.
Using CLI
Using CLI
To remediate the “RSASHA1 Should Not Be Used For Zone Signing” misconfiguration in GCP using GCP CLI, you can follow the steps below:
- Open the Cloud Shell in GCP Console.
-
Run the following command to list all the managed zones in your project:
- Choose the managed zone that you want to update and note down its name.
-
Run the following command to update the DNSSEC algorithm for the chosen managed zone:
Note: Replace [MANAGED_ZONE_NAME] with the name of the managed zone that you want to update.
-
Verify that the DNSSEC algorithm has been updated successfully by running the following command:
Note: Replace [MANAGED_ZONE_NAME] with the name of the managed zone that you updated in Step 4. The output of this command should be “RSASHA256”, which indicates that the DNSSEC algorithm has been updated successfully.
- Repeat Steps 4 and 5 for all the managed zones in your project.
Using Python
Using Python
To remediate the “RSASHA1 Should Not Be Used For Zone Signing” issue for GCP using Python, you can follow the below steps:
- First, you need to authenticate to GCP using the Google Cloud SDK and set up a project.
-
Next, you need to install the Google Cloud DNS API client library for Python using the following command:
-
Once the library is installed, you can write a Python script to retrieve the DNS zone for which you want to remediate the issue. You can use the following code snippet:
-
Once you have retrieved the DNS zone, you can update the zone signing algorithm to use a more secure algorithm. You can use the following code snippet to update the zone signing algorithm to RSASHA256:
-
Finally, you can verify that the zone signing algorithm has been updated by retrieving the DNS zone and checking the default key specification: