Secure DNS - Revision history

87.123.36.149: /* Securing Server-Server communication */

2005-09-13T16:46:48Z

Securing Server-Server communication

@@ Line 107: / Line 107: @@
 Extract this key and put it into both named.conf.local.
- key  ruth.snug.local-clod.snug.local. {
+ key  ruth.snug.local.-clod.snug.local. {
     algorithm hmac-md5;
     secret "OMx1JHEcK+grorUD7PV0sw==";
  };

192.168.4.128 at 06:53, 13 September 2005

2005-09-13T06:53:31Z

← Older revision		Revision as of 06:53, 13 September 2005
Line 93:		Line 93:

	The <tt>'''ad'''</tt> (Authentic Data) flag indicates a response that was successfully authenticated throught DNSSEC.		The <tt>'''ad'''</tt> (Authentic Data) flag indicates a response that was successfully authenticated throught DNSSEC.

			=Securing Server-Server communication=

			With a shared secret servers make sure that they receive secured and correct zones.

			How to create a shared secret?

			Every base64 string is okay - you can use a mime-encoded /dev/random or you can use the dnssec-keygen utility to generate good random base64 strings.

			dnssec-keygen -r /dev/random -a HMAC-MD5 -b 128 -n HOST tmp

			This creates two files: A .key file and a .private file, both contain base64 strings.
			Extract this key and put it into both named.conf.local.

			key ruth.snug.local-clod.snug.local. {
			algorithm hmac-md5;
			secret "OMx1JHEcK+grorUD7PV0sw==";
			};


			TODO: Primary + Secondary named.conf entries

Henryk: /* You're secure! */

2005-09-12T14:03:24Z

You're secure!

← Older revision		Revision as of 14:03, 12 September 2005
Line 69:		Line 69:
	dnssec-enable yes;		dnssec-enable yes;
	};		};

			==You're secure!==
			Now your zone should be secured. You can test this with <tt>dig</tt> for example:
			chunk:~$ dig ruth.snug.local

			; <<>> DiG 9.3.1 <<>> ruth.snug.local
			;; global options: printcmd
			;; Got answer:
			;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24773
			;; flags: qr rd ra '''ad'''; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

			;; QUESTION SECTION:
			;ruth.snug.local. IN A

			;; ANSWER SECTION:
			ruth.snug.local. 60 IN A 10.0.23.1
			ruth.snug.local. 60 IN A 10.0.42.1

			;; Query time: 3 msec
			;; SERVER: 127.0.0.1#53(127.0.0.1)
			;; WHEN: Mon Sep 12 16:01:39 2005
			;; MSG SIZE rcvd: 65

			The <tt>'''ad'''</tt> (Authentic Data) flag indicates a response that was successfully authenticated throught DNSSEC.

Henryk: /* Distributing the keys */

2005-09-12T13:49:04Z

Distributing the keys

← Older revision		Revision as of 13:49, 12 September 2005
Line 46:		Line 46:
	where <var>snug.local</var> is the name of the zone, K<var>snug.local.+005+40668</var> is the <em>base name</em> of the key-signing key, <var>db.snug.local</var> is the name of the zonefile and K<var>snug.local.+005+19919</var>.key is the public part of the zone-signing key.		where <var>snug.local</var> is the name of the zone, K<var>snug.local.+005+40668</var> is the <em>base name</em> of the key-signing key, <var>db.snug.local</var> is the name of the zonefile and K<var>snug.local.+005+19919</var>.key is the public part of the zone-signing key.

	The <tt>dnssec-signzone</tt> tool will then create an output zone file <var>db.snug.local</var>.signed which should be used instead of <var>db.snug.local</var> in the BIND configuration		The <tt>dnssec-signzone</tt> tool will then create an output zone file <var>db.snug.local</var>.signed which should be used instead of <var>db.snug.local</var> in the BIND configuration. Then reload the zones with <tt>rndc reload</tt>.

			==Distributing the keys==
			After the keys are in the DNS you need to distribute the Secure Entry Point to all resolvers that should use it. For this purpose <tt>dnssec-keysign</tt> generated a <tt>keyset-<var>snug.local.</var></tt> file which contains the public key that must be distributed. The file will contain something like
			snug.local 60 IN DNSKEY 257 3 5 (
			AQO3WtpCi9DeNLkgfGpHT2iWX2CheGzviden
			.....
			iJc0GqBEISlzeaOGS89h
			) ;
			From this the lifetime and <tt>IN DNSKEY</tt> must be stripped and the remaining entry put into the <tt>named.conf</tt> in a trusted-keys section like this:
			trusted-keys {
			"snug.local." 257 3 5 "
			AQO3WtpCi9DeNLkgfGpHT2iWX2CheGzviden
			....
			iJc0GqBEISlzeaOGS89h
			";
			};

			The verifying resolver also needs a
			options {
			recursion yes;
			dnssec-enable yes;
			};

Henryk: /* What You Need */

2005-09-12T12:59:21Z

What You Need

← Older revision		Revision as of 12:59, 12 September 2005
Line 6:		Line 6:

	==What You Need==		==What You Need==
	; BIND 9.3 : ~~<div>~~For example available in Debian Testing or Unstable. To get it into Debian Stable put the testing-sources into <var>/etc/apt/sources.list</var>, e.g. <pre><nowiki> deb http://ftp.de.debian.org/debian etch main		; BIND 9.3 : For example available in Debian Testing or Unstable. To get it into Debian Stable put the testing-sources into <var>/etc/apt/sources.list</var>, e.g. <pre><nowiki> deb http://ftp.de.debian.org/debian etch main
	deb http://security.debian.org/ etch/updates main</nowiki></pre> and into <var>/etc/apt/apt.conf</var>: <pre> APT::Default-Release "3.1*"</pre>You can then install bind 9.3 with<pre>apt-get install bind9/testing libisccc0/testing dnsutils/testing</pre>		deb http://security.debian.org/ etch/updates main</nowiki></pre> and into <var>/etc/apt/apt.conf</var>: <pre> APT::Default-Release "3.1*"</pre>You can then install bind 9.3 with<pre>apt-get install bind9/testing libisccc0/testing dnsutils/testing</pre>

Henryk: /* Signing Zones */

2005-09-12T12:53:45Z

Signing Zones

← Older revision		Revision as of 12:53, 12 September 2005
Line 38:		Line 38:
	WTF? For some even more stupid reason I can't use less-than signs in a comment, so I replaced them with [		WTF? For some even more stupid reason I can't use less-than signs in a comment, so I replaced them with [
	--[[User:Henryk\|Henryk]] 14:41, 12 Sep 2005 (CEST) -->		--[[User:Henryk\|Henryk]] 14:41, 12 Sep 2005 (CEST) -->

			After that the zone can be signed, e.g.
			dnssec-signzone -o <var>snug.local</var> \
			-k K<var>snug.local.+005+40668</var> \
			<var>db.snug.local</var> \
			K<var>snug.local.+005+19919</var>.key
			where <var>snug.local</var> is the name of the zone, K<var>snug.local.+005+40668</var> is the <em>base name</em> of the key-signing key, <var>db.snug.local</var> is the name of the zonefile and K<var>snug.local.+005+19919</var>.key is the public part of the zone-signing key.

			The <tt>dnssec-signzone</tt> tool will then create an output zone file <var>db.snug.local</var>.signed which should be used instead of <var>db.snug.local</var> in the BIND configuration

Henryk: /* Key-Management / and / Signing Zones */

2005-09-12T12:41:45Z

Key-Management: and Signing Zones

@@ Line 21: / Line 21: @@
 After each key generation the base name of the key files is printed, e.g.
- <var>Ksnug.local.+005+40668</var>
+ K<var>snug.local.+005+40668</var>
-With this base name two files are generated: the private key file (<tt><var>Ksnug.local.+005+40668</var>.private</tt>) and the public key file (<tt><var>Ksnug.local.+005+40668</var>.key</tt>). For obvious reasons the private key should be kept secret.
+With this base name two files are generated: the private key file (<tt>K<var>snug.local.+005+40668</var>.private</tt>) and the public key file (<tt>K<var>snug.local.+005+40668</var>.key</tt>). For obvious reasons the private key should be kept secret.

Henryk: /* Key-Management */

2005-09-12T12:05:33Z

Key-Management

← Older revision		Revision as of 12:05, 12 September 2005
Line 19:		Line 19:
	dnssec-keygen -f KSK -a RSASHA1 -b 2048 -n ZONE <var>snug.local</var>		dnssec-keygen -f KSK -a RSASHA1 -b 2048 -n ZONE <var>snug.local</var>
	for the key-signing key (where <var>snug.local</var> is the name of the zone). Of course you can choose keysize and algorithm to your heart's content (<tt>dnssec-keygen --help</tt> gives a list of possible combinations), but only DSA and RSASHA1 are required to be implemented. Note also that it would be wise to choose a stronger key for the KSK as it can't be changed easily. For the same reason it should be removed from the computer after use and brought to some safe storage.		for the key-signing key (where <var>snug.local</var> is the name of the zone). Of course you can choose keysize and algorithm to your heart's content (<tt>dnssec-keygen --help</tt> gives a list of possible combinations), but only DSA and RSASHA1 are required to be implemented. Note also that it would be wise to choose a stronger key for the KSK as it can't be changed easily. For the same reason it should be removed from the computer after use and brought to some safe storage.

			After each key generation the base name of the key files is printed, e.g.
			<var>Ksnug.local.+005+40668</var>
			With this base name two files are generated: the private key file (<tt><var>Ksnug.local.+005+40668</var>.private</tt>) and the public key file (<tt><var>Ksnug.local.+005+40668</var>.key</tt>). For obvious reasons the private key should be kept secret.

Henryk: /* Key-Management */

2005-09-11T21:16:47Z

Key-Management

← Older revision		Revision as of 21:16, 11 September 2005
Line 17:		Line 17:
	dnssec-keygen -a RSASHA1 -b 1024 -n ZONE <var>snug.local</var>		dnssec-keygen -a RSASHA1 -b 1024 -n ZONE <var>snug.local</var>
	for the zone-signing key and		for the zone-signing key and
	dnssec-keygen -f KSK -a ~~DSA~~ -b 2048 -n ZONE <var>snug.local</var>		dnssec-keygen -f KSK -a RSASHA1 -b 2048 -n ZONE <var>snug.local</var>
			for the key-signing key (where <var>snug.local</var> is the name of the zone). Of course you can choose keysize and algorithm to your heart's content (<tt>dnssec-keygen --help</tt> gives a list of possible combinations), but only DSA and RSASHA1 are required to be implemented. Note also that it would be wise to choose a stronger key for the KSK as it can't be changed easily. For the same reason it should be removed from the computer after use and brought to some safe storage.
	for the key-signing key (where <var>snug.local</var> is the name of the zone).

Henryk: /* Key-management */

2005-09-10T21:09:39Z

Key-management

← Older revision		Revision as of 21:09, 10 September 2005
Line 8:		Line 8:
	; BIND 9.3 : <div>For example available in Debian Testing or Unstable. To get it into Debian Stable put the testing-sources into <var>/etc/apt/sources.list</var>, e.g. <pre><nowiki> deb http://ftp.de.debian.org/debian etch main		; BIND 9.3 : <div>For example available in Debian Testing or Unstable. To get it into Debian Stable put the testing-sources into <var>/etc/apt/sources.list</var>, e.g. <pre><nowiki> deb http://ftp.de.debian.org/debian etch main
	deb http://security.debian.org/ etch/updates main</nowiki></pre> and into <var>/etc/apt/apt.conf</var>: <pre> APT::Default-Release "3.1*"</pre>You can then install bind 9.3 with<pre>apt-get install bind9/testing libisccc0/testing dnsutils/testing</pre>		deb http://security.debian.org/ etch/updates main</nowiki></pre> and into <var>/etc/apt/apt.conf</var>: <pre> APT::Default-Release "3.1*"</pre>You can then install bind 9.3 with<pre>apt-get install bind9/testing libisccc0/testing dnsutils/testing</pre>

			==Key-Management==
			It's best to generate two keypairs for each zone: a key-signing key (KSK) and a zone-signing key (ZSK).
			; Key-signing key : The key-signing key will only be used to sign the zone-signing key and will be the key that is transmitted to the parent zone as a designed signer or to the clients as a secure entry-point. If this key is rolled over all those parties will have to be informed.
			; Zone-signing key : This key is used to actually sign the zone data. If this key is rolled over it will only have to be resigned by the key-signing key with no external notification necessary.

			The keys are generated with
			dnssec-keygen -a RSASHA1 -b 1024 -n ZONE <var>snug.local</var>
			for the zone-signing key and
			dnssec-keygen -f KSK -a DSA -b 2048 -n ZONE <var>snug.local</var>
			for the key-signing key (where <var>snug.local</var> is the name of the zone).

Secure DNS - Revision history

87.123.36.149: /* Securing Server-Server communication */

192.168.4.128 at 06:53, 13 September 2005

Henryk: /* You're secure! */

Henryk: /* Distributing the keys */

Henryk: /* What You Need */

Henryk: /* Signing Zones */

Henryk: /* Key-Management */ and /* Signing Zones */

Henryk: /* Key-Management */

Henryk: /* Key-Management */

Henryk: /* Key-management */

Henryk: /* Key-Management / and / Signing Zones */