DNSSec: Difference between revisions

From
Jump to navigation Jump to search
No edit summary
No edit summary
Line 31: Line 31:
The following command will generate a 768-bit RSASHA1 key for the child.example zone:
The following command will generate a 768-bit RSASHA1 key for the child.example zone:
dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example.
dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example.


openssl base64 -e -in dateimitgeheimnis >> dateimitgeheimnisbase64

Revision as of 07:55, 22 September 2011

DNSSEC:

zwei unterschiedliche ansaetze:

  • komplette chain-of-trust von root zu jeweiliger zone
  • "schatten-dns" ueber dlv.isc.org

benutzte tools: bind 9.7.3 dig dnssec-tools validator (debianpaket in stable veraltet, selbst compilieren)


beispiele:

- validierung klappt ueber dlv aber nicht ueber "normal"


drill:

trust key erstellen: dig +dnssec -t DNSKEY dlv.isc.org >> dlv.trusted.key alles rausloeschen ausser: "dlv.isc.org. IN DNSKEY 257 ....." (die zahl zwischen dlv.isc.org und IN muss auch weg) drill -DS dlv.isc.org -k dlv.trusted.key


pro zone 1 oder mehr keys - darf zur zeit nur RSASHA1 sein: bind 9.7 manual 4.8.1: It is recommended that zone keys use a cryptographic algorithm designated as ”mandatory to implement” by the IETF; currently the only one is RSASHA1. The following command will generate a 768-bit RSASHA1 key for the child.example zone: dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example.


openssl base64 -e -in dateimitgeheimnis >> dateimitgeheimnisbase64