DNSSec: Difference between revisions
Jump to navigation
Jump to search
mNo edit summary |
No edit summary |
||
| Line 14: | Line 14: | ||
- validierung klappt ueber dlv aber nicht ueber "normal" |
- validierung klappt ueber dlv aber nicht ueber "normal" |
||
pro zone 1 oder mehr keys - darf zur zeit nur RSASHA1 sein: bind 9.7 manual 4.8.1: |
|||
It is recommended that zone keys use a cryptographic algorithm designated as ”mandatory to implement” by the IETF; currently the only one is RSASHA1. |
|||
The following command will generate a 768-bit RSASHA1 key for the child.example zone: |
|||
dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example. |
|||
Revision as of 05:30, 22 September 2011
DNSSEC:
zwei unterschiedliche ansaetze:
- komplette chain-of-trust von root zu jeweiliger zone
- "schatten-dns" ueber dlv.isc.org
benutzte tools: bind 9.7.3 dig dnssec-tools validator (debianpaket in stable veraltet, selbst compilieren)
beispiele:
- validierung klappt ueber dlv aber nicht ueber "normal"
pro zone 1 oder mehr keys - darf zur zeit nur RSASHA1 sein: bind 9.7 manual 4.8.1:
It is recommended that zone keys use a cryptographic algorithm designated as ”mandatory to implement” by the IETF; currently the only one is RSASHA1.
The following command will generate a 768-bit RSASHA1 key for the child.example zone:
dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example.