cgi program for managing DNS written in Python

Updates

January, 2016:
	-Added support for nameserver per-zone
	-Added check for chosen zone existing in config.txt but not at nameserver

Overview

This cgi program uses zone transfers and secure dynamic updates to manage DNS zones.
Originally, this was written as a bourne shell script, but I ran into a lot of issues with limitations of sed on Solaris. My method of parsing variables that were passed to the form was not flexible enough. You can see the original information on this tool here
I re-wrote this in python to isolate the tool from the underlying OS
Some of the benefits of using a web-based interface are:

Once you start using dynamic updates, the zone transfers to slaves will be incremental (much faster)
Because the server is maintining the zone, its impossible to add syntactically incorrect entries into the zone.

The program (actually, not the program, but dynamic updates) have a couple of nasty side-effects too:

Once you start using dynamic updates, you can no longer edit the zone file directly.
You can't even look at zone file to check the zone contents - since there is a .jnl file that modifies the contents of the zone in memory. (NB: I just read that you can actually use "rndc freeze zonename" to cause the changes to be committed. Remember to use "rndc unfreeze zonename" after.)

How to set it up

Download the script here
Download dnspython library here
(I used the rpm from here)

Place dnstool.py into your cgi-bin directory
Make sure it is executable by the user that owns the web server process
Edit the dnstool.py program and change the values of the variables cgiScript, zonefile and nameserver. DO NOT place zones.txt in the cgi-bin directory as it contains the update keys for the zone

Populate the zonefile with the names of the zones you will manage. At minimum, the name of the zone and the nameserver for that zone are required - but that will only allow viewing of the zone. If you want the full update functionality to work, you will need to create keys and respectively include the keyname and the key in the zones.txt file. Assuming I want to add foobar.internal to my list of zones that I would like to manage. I would create the keys like this:

dnssec-keygen -a HMAC-MD5 -b 256 -n ENTITY foobar.internal

then I would update the named.conf to allow dynamic updates for that zone listed in the zones.txt file. I added the following:

key foobar.internal. {
        algorithm hmac-md5;
        secret "qgVjEPYFwHfrywGNmRjOmeENk36rf94nxlEi0rlLlFo=";
};

....... snip .....

zone "foobar.internal" {
        type master;
        file "db.foobar";
        allow-update {key foobar.internal;};
};
....... snip .....

The "secret" is the "key" entry from the Kfoobar.internal.+157+21306.private file that was generated above.

create the file db.foobar containing something like this:

$TTL 86400      ; 1 day
foobar.internal.     IN SOA  woodyint.unixpeople.internal. hostmaster.unixpeople.com. (
                                2006114532 ; serial
                                28800      ; refresh (8 hours)
                                14400      ; retry (4 hours)
                                3600000    ; expire (5 weeks 6 days 16 hours)
                                3600       ; minimum (1 hour)
                                )
                        NS      woodyint.unixpeople.internal.
woody2                  A       192.168.37.12

restart named and check for errors in /var/adm/messages, or /var/log/messages

Verify that the zone is ok

$ ping woody2.foobar.internal
PING woody2.foobar.internal (192.168.37.12) 56(84) bytes of data.
64 bytes from woody2.unixpeople.internal (192.168.37.12): icmp_seq=1 ttl=64 time=0.304 ms
64 bytes from woody2.unixpeople.internal (192.168.37.12): icmp_seq=2 ttl=64 time=0.339 ms

Add the line to the zones.txt file:

foobar.internal foobar.internal. qgVjEPYFwHfrywGNmRjOmeENk36rf94nxlEi0rlLlFo= 192.168.37.12

A complete config.txt might look like this:

unixpeople.internal unixpeople.internal. qgVjEPYFwHfrywGNmRjOmeENk36rf94nxlEi0rlLlFo= 192.168.37.12
unixpeople.com dynupdates. qgVjEPYFwHfrywGNmRjOmeENk36rf94nxlEi0rlLlFo= 107.21.97.57
37.168.192.in-addr.arpa unixpeople.internal. qgVjEPYFwHfrywGNmRjOmeENk36rf94nxlEi0rlLlFo= 192.168.37.12
dnsbl.unixpeople.com dynupdates. qgVjEPYFwHfrywGNmRjOmeENk36rf94nxlEi0rlLlFo= 107.21.97.57
impala59.com dynupdates. qgVjEPYFwHfrywGNmRjOmeENk36rf94nxlEi0rlLlFo= 107.21.97.57
vksellshomes.com 107.21.97.57
smilefamilyportraits.com dynupdates. qgVjEPYFwHfrywGNmRjOmeENk36rf94nxlEi0rlLlFo= 107.21.97.57
objectmatrix.com dynupdates. qgVjEPYFwHfrywGNmRjOmeENk36rf94nxlEi0rlLlFo= 107.21.97.57
tvmites.com dynupdates. qgVjEPYFwHfrywGNmRjOmeENk36rf94nxlEi0rlLlFo= 107.21.97.57
sathseva.org dynupdates. qgVjEPYFwHfrywGNmRjOmeENk36rf94nxlEi0rlLlFo= 107.21.97.57
foobar.internal foobar.internal. qgVjEPYFwHfrywGNmRjOmeENk36rf94nxlEi0rlLlFo= 192.168.37.12
emcscientific.com dynupdates. qgVjEPYFwHfrywGNmRjOmeENk36rf94nxlEi0rlLlFo= 107.21.97.57

Launch a browser and point it to the dnstool.py and you should see the zone listed.
Try adding and deleting an RR. It should work.

Suggestions

You should definitely ensure that users must authenticate before running this cgi script
You should probably run this on an SSL-based web site