untitled

Size: px

Start display at page:

Download "untitled"

琢顼林
7 years ago
Views:

1 DNSSEC Authoritative Server SOP 易 2.12 參李

2 錄 UBUNTU APTITUDE BIND CENTOS YUM BIND FREEBSD PORTS COLLECTION BIND BIND NAMED.CONF.OPTIONS 金立 RR 降 DNS DNSSEC 理 CENTOS RHEL OS 狀 ZONE FILE SLAVE 狀利 SIGCHASE 參數 DNSSEC... 21

3 1. SOP BIND DNSSEC authoritative server 流說精不金不 nsupdate zone file DNSSEC 不 DLV DS 說金理量 ZSK KSK 金理不理便量 2048 bits KSK 不 ZSK 不金理度 European Network of Excellence in Cryptology II 2010 年 3 RSA 2048bits 金 ASIC 10 年來說 DNSSEC 金來 Resource Record 理理數金若讀 DNSSEC authoritative server 行參

4 Ubuntu aptitude BIND Ubuntu 理行令 aptitude install bind9 dnsutils 2.2. CentOS yum BIND CentOS 6.2 理行令 yum install bind rndc rndc.key rndc-confgen -a -r /dev/urandom chown root:named /etc/rndc.key chmod 640 /etc/rndc.key SOP Ubuntu CentOS 料 2.3. FreeBSD Ports Collection BIND FreeBSD 9.0-RELEASE BIND 9.8 列 ports tree dns/bind98 錄切 BIND 9.8 列 # cd /usr/ports/dns/bind98

5 行 # make config 裡 SSL DNSSEC REPLACE_BASE base system BIND FreeBSD 8.2 BIND 9.6.x SIGCHASE dig DNSSEC 行 # make install clean SOP Ubuntu FreeBSD 料

6 BIND Ubuntu aptitude BIND CentOS 6.2 理行令 # chkconfig named on BIND FreeBSD 9.0-RELEASE /etc/rc.conf # vi /etc/rc.conf named_enable="yes" BIND 3.2. named.conf.options named.conf.options root@ubuntu:~$ vi /etc/bind/named.conf.options

7 options { directory "/var/cache/bind"; dnssec-enable yes; dnssec-validation auto; dnssec-lookaside auto; // Authoritative-only Name Server allow-query-cache { none; }; allow-query { any; }; recursion no; // Set Secure Default allow-transfer { none; }; notify yes; auth-nxdomain no; # conform to RFC1035 listen-on-v6 { any; }; }; 錄 named.conf.local zone root@ubuntu:~$ vi /etc/bind/named.conf.local example.com 例 master zone "example.com." { type master; auto-dnssec maintain; update-policy local; allow-transfer { slaves_list }; file "/etc/bind/example.com/db.example.com.signed"; key-directory "/etc/bind/example.com"; }; 行 slaves_list 更 slave server 列

8 auto-dnssec maintainbind 行金更 update-policy local 參數 named auto-dnssec 更 DNSSEC RRSIG file key-directory zone file DNSSEC 金路 zone file db.example.com.signed db.example.com 理 db.example.com db.example.com.signed BIND 若 slave zone "example.com." { type slave; masters { masters_list }; allow-transfer { none; }; file "/etc/bind/example.com/db.example.com.signed"; }; 行 masters_list 更 master server 列 zone file 金料 root@ubuntu:~$ mkdir /etc/bind/example.com master zone file zone file BIND zone filebind zone file root@ubuntu:~$ vi /etc/bind/example.com/db.example.com

9 db.example.com 例 $TTL IN SOA example.com. admin.example.com. ( 1 ; Serial 3600 ; Refresh 600 ; Retry ; Expire 600 ; Negative Cache TTL ) IN NS IN NSEC3PARAM ns IN A NSEC3PARAM 來 BIND NSEC3 NSEC3 參數例 Iteration 100 度暴力 salt 度例 salt 61 六串 (0-F 度 2 數 ) 亂度 3.3. 金金理金 master slave 金令例 root@ubuntu:~$ dnssec-keygen \ -a NSEC3RSASHA1 \ -b 2048 \ -f KSK \ -r /dev/urandom \ -K /etc/bind/example.com \

10 example.com 參數說 1) a 金 2) b 金度 3) f 金 flag 4) r 亂數來 5) K 金錄 6) Zone name 令金兩 Knnnn.+aaa+iiiii key-directory 錄來立 3.4. zone 令 root@ubuntu:~$ dnssec-signzone \ \ -H 100 \ -K /etc/bind/example.com \ -o example.com \ -S \ -u \ -z \ /etc/bind/example.com/db.example.com 參數說 1) -3NSEC3 salt 2) -HNSEC3 Iteration 3) -K 金料 4) -o 5) -SSmart signing

11 6) -u 更 NSEC/NSEC3 7) -z : KSK 來 zone file 8) zone file 令金料金來 zone file.signed zone file zone file 錄 zone file BIND zone file 3.5. named 行 BIND 不 named 行不例來說若金 root named bind 來行 named 行令更錄 root@ubuntu:~$ chown -R bind /etc/bind/example.com 令 BIND root@ubuntu:~$ rndc reload dig 來 root@ubuntu:~$ dig +dnssec +multiline -t dnskey 若 DNSKEY RRSIG example.com IN DNSKEY ( AwEAAdNW7YIhcTdqXrzgZjJJ35VjAFT1ArvnhAzXDm7A ugxsqqmgbrmjjvbv0xs4gahb9mj6ekf0dvkoezglmnaj

12 o8hj2ji7k281yto2r5k3mksc4hocp55hr22r5hispjot 19pv/VdZQfyTzZ96frQ16qRa9+/GSjzjtFfQv16FwE7R ) ; key id = example.com IN DNSKEY ( AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQ bsew0o8gccjffvqutf6v58fljwbd0yi0ezracqqbgczh /RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWA JQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXp oy68lsvpvjr0zswzz1apazvn9dlzehex7icjbbtua6g3 LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGO Yl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGc LmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0= ) ; key id = example.com IN RRSIG DNSKEY ( NM23qUtTFHno+V6TVGO5cyohgVZEBLWDMRnI8lv78SWs YJFbBP0xWERfHloiWZhOoONsbXn2QAWbYaR0Iiysu64A hree92lfgdxafyrisrwqjo6loixc7gvorrpwpeng9eua FZEO94Z7SetqGXo4uPwuxQLen14MLOBjE5Hjj+dyuBQk yy4hr2celyuebvr5eosxzhczijfpjro7ldsoxbyfw8v+ o2lw9zu+nqsgiboxlagx0jd/syvcmmctmuz8csvsavfy nj4g5mgk052dqmzfn9u38e+6fuh/upphhdrcujfswi/l ZnfoebROk5+nuk0gJGUSrdPyoCfsiMNbKQ== ) 3.6. 立錄金 Hash 念類 DNS NS 立 DS DLV 兩 DNSSEC DS 串 DNSSEC DNSSEC 不 DLV

13 DS DS 錄切金錄令 dnssec-dsfromkey Knnnn.+aaa+iiiii Knnnn.+aaa+iiiii 錄金料例來說料 example.com. IN DS E2C F275A89480AA EC6DBDF9 example.com. IN DS C75FCABBB34F633DAC3D08BDCEB29D46A3E36EE0E2CC7F 48726A 34C04A45 DS 錄理 NS 類令 root@ubuntu:~$ dig +dnssec -t ds example.com 3.7. 若 DNSSEC authoritative server 令 root@ubuntu:~$ dig +dnssec -t soa 裡 DNSSEC authoritative server DNSSEC resolver 來若 ad flag

14 4. DNSSEC 若 RR DNSSEC 參 4.1. RR 若理 zone file 更 1) zone file 2) zone 3) zone file 4) zone file owner 5) zone BIND 裡 zone file db.example.com.signed zone file db.example.com 令 db.example.com.signed 令 1) zone file zone file(db.example.com) 理 DNS 2) zone 行令

15 rndc freeze 令 zone data(db.example.com.signed) 更 BIND zone data 不讀 zone file(db.example.com.signed) 來 3) zone file zone 令 dnssec-signzone \ \ -H 100 \ -K /etc/bind/example.com \ -o example.com \ -S \ -u \ -z \ /etc/bind/example.com/db.example.com zone file (db.example.com) zone file (db.example.com.signed) zone file zone file 3.4 4) zone file owner OS 理不說 root 來行 owner root OS bind 來 bind owner Ubuntu 來說行令 root@ubuntu:~$ chown -R bind /etc/bind/example.com

16 5) zone BIND zone file 復令 rndc thaw 令理 script 降理 4.2. 降 DNS DNSSEC 連串金 DNSSEC 不 DNSSEC resolver 不 DNS 若理 DNSSEC 不降 DNS resolver DNSSEC 降 DNS DS record DS record 不 DNSSEC resolver 不金 DS cache DS DS TTL ( 300) 4.3. DNSSEC 理來說 2048 bit 金度暴力不易

17 DNSSEC 金理 DNSSEC 若 4.2 降 DNS 3 金立 DNSSEC DNSSEC 度不 zone file TTL DNSSEC resolver cache 金 RRSIG 參更金不 DNSSEC 更金

18 見 BIND 利令 named-checkconf 來利 named-checkzone 來 zone file DS TTL 300 不 resolver cache 5 降 DNS 了 DS RR 300 來流量 5 來不 cache 流量不了 RR DNSKEY RR( SOA A record) TTL 降 SOA Negative TTL 300 來若 resolver query 不 RR 5 了 ntp 來 masterslave resolver 精 5.3. CentOS RHEL CentOS 6.2 RHEL 6.2 nsupdate 令 bug memory dump 不不兩 nsupdate 令

19 精 SOP 令 RHEL 6.2 SOA SOA 參數 master name server FQDN 參數利理不 OS 裡 (FreeBSDUbuntuCentOSRHEL) RHEL 參數不 Slave 不 RRSIG bug master name server 不 RRSIG 邏 view zone transfer delay RHEL 6.2 理 process 讀 5.4. OS 若理 Linux SELinux FreeBSD mtree 兩來了讀 BIND 錄 resolver BIND 更 root 金 authoritative server SELinux mtree CPU 5.5. 狀理行 SOP 行漏易不見

20 DNSSEC resolver BIND 來說 RRSIG RRSIG BIND zone file 若狀列兩 1) / 錄 named 行 zone 錄錄 ( 金 zone file ) SOP 3.5 BIND 不 named 行不 Ubuntu 來說 named 行 bind 若 zone file 金 root BIND zone file RRSIG 參 SOP 3.5 zone 錄錄 ( 金 zone file ) owner 更 named 行 2) update-policy local 參數 SOP 3.2 了 auto-dnssec maintain 參數 update-policy local 參數 named DNSSEC RRSIG BIND local 更 auto-dnssec 更 zone file RRSIG 參 SOP 3.2 named.conf.local update-policy local 參數 5.6. Zone file Slave 狀理行 SOP 若 slave zone file 狀列兩

21 1) / 錄 slave named 行 zone 錄錄 slave 料參 SOP 3.5 slave zone 錄錄 owner 更 named 行 2) master zone file slave NS A SOP master zone file slave 行 master slave zone file NS 錄 slave master zone file slave NS A 5.7. 利 sigchase 參數 root.com.example.com dig 令 sigchase 參數更 sigchase 參數列 root 錄錄 1) root DNSKEY sigchase root DNSKEY 令來錄 root@ubuntu:~$ dig +nocomments +nostats +nocmd +noquestion -t dnskey. > trusted-key.key

22 2) 令 dig +topdown +sigchase +multiline -t a 參數說 +sigchase +topdown root 參數 root 不參數 root 若列 FINISH : we have validate the DNSSEC chain of trust: SUCCESS 若 fail 錄來裡 topdown 參數不 root root 兩來兩 sigchase 參數 BIND BIND sigchase 參數 dig 行不

23 5.8. DNSSEC 利 BIND dig 令 sigchase 參數來路裡 sigchase 參數更易 DNSSEC 兩 DNSSEC Analyzer DNSViz 來理 DNSSEC DNSSEC Analyzer DNSViz 更理 DNSSEC Analyzer 列 1) 度 DNSViz

24 2) 若裡 icon 1) 列 DNSViz 不 2) DNSKEY/DS 不 DNSViz DNSViz

25 1) 理 2) 滑 DNSKEY/DS icon 1) 度 DNSSEC Analyzer 2) 理 DNSSEC Analyzer

untitled

untitled TWISC@NCTU DNSSEC Authoritative Server SOP 2.12 TWISC@NCTU 參李錄 1.... 1 2.... 2 2.1.... 2 2.2. BIND... 2 2.3. BIND... 3 3.... 4 3.1. 立... 4 3.2. 金... 6 3.3.... 12 3.4. 立... 14 3.5.... 19 4.... 20 4.1.