I have several windows systems in a Linux network with BIND9 DNS as well as an active directory domain. We do not use the windows domain controllers for DNS. In order to ensure all of the systems are registered in DNS, I have deployed a script to each system that uses the Windows nsupdate binary to register the Windows systems in BIND. This works well for desktops and laptops and triggers on network state change.
The concern here is that if the TSIG key is compromised on these workstations, any internal record could be updated or deleted. I've mitigated this by setting the script and keyfiles to be readable by the SYSTEM account only and the systems are all FDE with a boot pin.
Host names in the organization follow a repeatable convention, and workstations always start with W. Is there a way to restrict the host-key in BIND9 to only update or add hosts with this prefix?
I would like to avoid creating another zone to isolate the workstation tsig keys from the rest of the account services but this will be my next option.