IP-related security issues + DNS + DHCP

Size: px

Start display at page:

Download "IP-related security issues + DNS + DHCP"

弄连宿
6 years ago
Views:

1 DNS + DHCP Michael Tsai 2017/05/01

2 DNS + DHCP DNS: domain name < > IP address DHCP: gives you a IP + configuration when you joins a new network

3 DHCP = Dynamic Host Configuration Protocol

4 DHCP (Dynamic Host Configuration Protocol) 每個地方有自己的 subnet 及 IP 設定到一個新的地方, 一開始怎麼取得此一 subnet 的 IP 呢? 通常同一個 subnet 中會設置一台 DHCP server 此 server 將負責接待新來的機器, 分發未使用的 IP 給它們想像全系如果都需要手動設定 IP, 會發生什麼事情? 網管需要分配 IP 給所有電腦 ( 全系有多少電腦???) IP 衝突 ( 同樣的 IP 被不同的電腦使用 )

DHCP 4 部曲 DHCP Discover: 請問有人可以發 IP 給我嗎? Src: 0.0.0.0, 68 Dest: 255.255.255.255, 67 DHCPDISCOVER Yiaddr: 0.0.0.0 Transaction ID: 654 Request: Subnet Mask, Router, Domain Name Server DHCP Offer: 我這邊有一組 IP 看看你要不要用.

5 DHCP 4 部曲 DHCP Discover: 請問有人可以發 IP 給我嗎? Src: , 68 Dest: , 67 DHCPDISCOVER Yiaddr: Transaction ID: 654 Request: Subnet Mask, Router, Domain Name Server DHCP Offer: 我這邊有一組 IP 看看你要不要用. Src: , 67 Dest: , 68 DHCPOFFER Yiaddr: DHCP server ID: Transaction ID: 654 Lifetime: 4 hrs Netmask: Router: DNS: ,

DHCP 4 部曲 DHCP Request: 那我要把這組 IP 拿走囉! Src: 0.0.0.0, 68 Dest: 255.

15 Transaction ID: 655 DHCP server ID: 192.168.55.254 Lifetime: 4 hrs DHCP Ack: 沒問題.

6 DHCP 4 部曲 DHCP Request: 那我要把這組 IP 拿走囉! Src: , 68 Dest: , 67 DHCPREQUEST Yiaddr: Transaction ID: 655 DHCP server ID: Lifetime: 4 hrs DHCP Ack: 沒問題. 請用. Src: , 67 Dest: , 68 DHCPACK Yiaddr: DHCP server ID: Transaction ID: 655 Lifetime: 4 hrs Netmask: Router: DNS: ,

7 Some additional facts Originally designed as BOOTP - for diskless workstations. Today, You can still use PXEBOOT on various network 7 interface card for diskless operation. A server keeps track of lease (of IPs), which would expire after a predefined time period A client usually renews the lease when the time is half over The lease information must survive reboot for network stability A typical lease entry: lease { starts /06/27 00:40:00; ends /06/27 12:40:00; hardware ethernet 00:00:00:00:00:00; uid 00:00:00:00:00:00; client-hostname "examle-workstation1"; }

8 DHCP 的細節一個 subnet 上可能有多個 DHCP server. 因此發出 DHCPREQUEST 之後, 可能收到多個 DHCPOFFER Client 可以要求使用之前使用過的 IP, 但 DHCP server 可以拒絕 ( 可能根本已經不在同一個網段, 或是已經被別的 client 使用中 ) Authoritative & non-authoritative: 有主管權的 DHCP server 可以發出拒絕 client 使用某 IP 的要求, 而沒有主管權的 DHCP server 則會忽略該要求 ( 沒有回應 ) 想想看 : DHCP server 的安全漏洞. 如果有人接在系上網路上且開啟 DHCP server, 會發生什麼事情?

9 A typical DHCP server configuration file The following dhcpd.conf is used by ISC DHCPD default-lease-time 600; max-lease-time 7200; option subnet-mask ; option broadcast-address ; option routers ; option domain-name-servers , ; option domain-search "example.com"; subnet netmask { range ; } host apex { option host-name "apex.example.com"; hardware ethernet 00:A0:78:8E:9E:AA; fixed-address ; } 9

10 DNS = Domain Name System

11 DNS (Domain Name Service) 一言以蔽之 : 將名稱轉為 IP 的服務常見的轉換種類 : Domain name -> IP (type A): ntucsv.csie.ntu.edu.tw -> 的 mail server (type MX): csie.ntu.edu.tw -> ms.csie.ntu.edu.tw Domain name -> domain name (type CNAME): -> ntucsv.csie.ntu.edu.tw IP -> domain name (type PTR) > csman.csie.ntu.edu.tw 可以多重宣告 : 增加可靠度或分散性. 例如

12 Delegation = distributed

13 DNS Basics Forward mapping: domain name > IP Reverse mapping: IP > domain name Master (primary) server: holds the reference copy of the domain data Slave (secondary) server: copy the data from the master server Caching-only server: holds the domain data only temporarily in cache Zone transfer: the copying or propagation of DNS data from master to slave

14 DNS Basics Authoritative: from the server responsible for that zone Non-authoritative: from caching server (your local DNS) TTL (time-to-live): How long can the caching server save the answer in the (temporary) database Example: roots: 42 days edu: 2 days berkeley.edu: 2 days vangogh.cs.berkeley.edu: 1 day Example: moving CSIE servers to BL > set TTL to be 1 hr or less

15 Resource Records IN MX 10 mail mail IN A Mail server www IN CNAME mvnl.csie.ntu.edu.tw. mvnl IN NS ns-mvnl Sub-domain Alias ns-mvnl IN A Forward 208 IN PTR mvnl.csie.ntu.edu.tw. Reverse

16 Resource Records ; the current zone name () allows data to span line IN Internet (default) Formal syntax: zone [ttl] [IN] record_type record_content

17 SOA record ; start of the authority record for IN SOA ns.nasa2015.com. root.nasa2015.com. ( ; serial number ; refresh (3 hr) 1200 ; retry (20 min) ; expire (40+ day) 3600 ) ; minimum ( 1 hr)

18 Considerations in DNS service No name service = no service at all (mostly) Diversity: Geographically, software, etc. Standalone (not many users) Uninterruptible power supply Two slaves, one is off-site Separate authoritative and caching-only servers (security)

19 DNS can be used for attacks! DNS spoofing (cache poisoning) Redirect the user to a malicious server instead of the official server DNS hijacking DNS DDoS (reflection / amplification) Request (30 bytes) versus response (3297 bytes): 100x! Send requests to a large number of DNS servers on behalf of the host to be attacked (no check on the source IP) Mitigation (DNS server): limit the hosts (with IP in certain ranges) which can query your DNS

PowerPoint Presentation

PowerPoint Presentation 立 97 年度 SNMG 練 DNS & BIND enc1215@gmail.com DNS BIND Resolver Named 理 Named 更 DNS DNS Reference 2 DNS DNS 料 domain ip DNS server DNS server 理 DNS server DNS DNS 狀. root name server 理 3 DNS 狀 DNS (2). com