{"id":4426,"date":"2015-03-28T21:19:33","date_gmt":"2015-03-28T19:19:33","guid":{"rendered":"http:\/\/www.imacandi.net\/sin\/blog\/?p=4426"},"modified":"2015-03-28T21:19:33","modified_gmt":"2015-03-28T19:19:33","slug":"dnssec-1","status":"publish","type":"post","link":"https:\/\/www.imacandi.net\/sin\/blog\/2015\/03\/28\/dnssec-1.html","title":{"rendered":"dnssec (1)"},"content":{"rendered":"<p style=\"text-align: justify;\">DNS-ul este unul din protocoalele care reprezinta coloana verterbrala a Internetului. Cand a fost inventat, securitatea nu a fost luata in calcul pentru ca s-a mers pe ideea ca toti utilizatorii o sa fie cinstiti, lucru care s-a dovedit un pic fals. DNS-ul a fost abuzat de tot felul de oameni pentru diverse scopuri, mai mult sau mai putin oneroase.<\/p>\n<p style=\"text-align: justify;\">Cele mai intalnite abuzuri asupra lui sunt &#8220;<a title=\"DNS cache poisoning\" href=\"https:\/\/en.wikipedia.org\/wiki\/DNS_spoofing\">cache poisoning<\/a>&#8221; si <a title=\"Man in the middle Attack (MITM)\" href=\"https:\/\/en.wikipedia.org\/wiki\/Man-in-the-middle_attack\">Man-in-the-Middle<\/a> (MITM).<\/p>\n<p style=\"text-align: justify;\">Pentru a face protocolul rezilient asupra acestor doua tipuri majore de atacuri si pentru a putea lansa noi servicii sigura bazate pe DNS, un grup de oameni destepti s-au gandit sa adauge si securitate la protocol. Pentru ca e relativ mult de vorbit despre partea de securitate si ideile nu vin toate o data, exista vreo 3 RFC-uri mari care acopera specificatiile de DNSSEC: <a title=\"RFC 4033\" href=\"https:\/\/tools.ietf.org\/html\/rfc4033\">4033<\/a>, <a title=\"RFC 4034\" href=\"https:\/\/tools.ietf.org\/html\/rfc4034\">4034<\/a> si <a title=\"RFC 4035\" href=\"https:\/\/tools.ietf.org\/html\/rfc4035\">4035<\/a>.<\/p>\n<p style=\"text-align: justify;\">Pe scurt, o autoritate centrala va garanta\u00a0in jos &#8220;zonele&#8221; de DNS pana la ultimul domeniu astfel incat daca un server de DNS care stie de DNSSEC trebuie sa rezolve un nume de host sau de domeniu, va putea verifica foarte usor ca raspunsurile primite nu au fost modificate in tranzit de catre o terta parte.<\/p>\n<p>DNSSEC foloseste\u00a0doua tipuri de chei:<\/p>\n<ul>\n<li style=\"text-align: justify;\">KSK sau Key Signing Key: este cheia cu care sunt semnate inregistrarile de tip DNSKEY. O data create aceste chei, se creaza si inregistrarile de tip DS care for fi publicate in zona domeniului parinte astfel incat sa se realizeze cum trebuie &#8220;chain of trust&#8221;.<\/li>\n<li>ZSK sau Zone Signing Key: este cheia cu care sunt semnate toate inregistrarile (zona) unui server de DNS autoritativ.<\/li>\n<\/ul>\n<p>Ca si tipuri de inregistrari, atunci cand avem DNSSEC, avem:<\/p>\n<ul>\n<li style=\"text-align: justify;\">RRSIG: reprezinta semnatura digitala pentru o inregistrare in DNS.<\/li>\n<li style=\"text-align: justify;\">DNSKEY: reprezinta cheia publica pe care resolver-ul de DNS o foloseste pentru a verifica autenticitatea raspunsului primit<\/li>\n<li style=\"text-align: justify;\">DS sau Delegation Signer: reprezinta informatii despre cheile folosite de un domeniu pentru semnarea lor. Inregistrarile de tip DS se pun doar in domeniul parinte si fac referinta la subdomeniul pentru care sunt folosite. Aceste inregistrari reprezinta un HASH al cheilor de semnare efective pentru micsora transferul de date pentru validarea unei semnaturi.<\/li>\n<li style=\"text-align: justify;\">NSEC: reprezinta un pointer la urmatoarele inregistrari dintr-o zona si la tipuri de inregistrari existente. Este folosit pentru a valida existenta sau inexistenta inregistrarilor dintr-un domeniu.<\/li>\n<li>NSEC3: la fel ca NSEC, insa cu o modificare pentru sporirea rezilientei protocolului si pentru a face imposibila enumerarea tuturor inregistrarilor dintr-o zona de DNS<\/li>\n<li style=\"text-align: justify;\">NSEC3PARAM: este folosit de serverele autoritative pentru a decide ce alte inregistrari pot fi trimise unui client care efectueaza interogari pe langa tipul de inregistrare solicitat explicit.<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">&#8220;Trust anchors&#8221; reprezinta mecanismul prin care un server de DNS are incredere in anumite semnaturi pentru domenii. Echivalentul ar fi &#8220;root hints&#8221; sau in PKI: lista autoritatilor de certificare in care are incredere (Trusted Root CAs).<\/p>\n<p>Acum, partea practica :)<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-4429\" src=\"http:\/\/www.imacandi.net\/sin\/blog\/wp-content\/uploads\/2015\/03\/dnssec_1.jpg\" alt=\"dnssec_1\" width=\"606\" height=\"310\" srcset=\"https:\/\/www.imacandi.net\/sin\/blog\/wp-content\/uploads\/2015\/03\/dnssec_1.jpg 606w, https:\/\/www.imacandi.net\/sin\/blog\/wp-content\/uploads\/2015\/03\/dnssec_1-300x153.jpg 300w\" sizes=\"auto, (max-width: 606px) 100vw, 606px\" \/><\/p>\n<p>Si pentru ca mi-am dorit mereu un TLD, o sa-l numesc .imacandi. pentru postul asta si o sa avem asa:<\/p>\n<pre>[root \".\"] =&gt;\r\n\r\n[TLD \"imacandi.\"] =&gt;\r\n\r\n[domeniu \"sin.imacandi.\"]<\/pre>\n<p style=\"text-align: justify;\">Plus un resolver pe langa astea care are doar cheia publica a &#8220;.&#8221; si va face rezolvare recursiva pentru $hostname.sin.imacandi.net.<\/p>\n<p>Servere si adrese IP:<\/p>\n<ul>\n<li>dns-s-1 (root server) \/ 172.16.155.101<\/li>\n<li>dns-s-2 (ns for .imacandi.) \/ 172.16.155.102<\/li>\n<li>dns-s-3 (ns for sin.imacandi.) \/ 172.16.155.103<\/li>\n<li>dns-s-5 (resolver) \/ 172.16.155.108<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">(da stiu ca pe poza sunt mai multe servere, da m-a luat desenatul pe dinainte si dupa aia mi-am dat seama ca ma pot descurca si cu mai putine)<\/p>\n<p>Ca si software voi folosi BIND 9.9.4 pe CentOS 7 (default).<\/p>\n<p>Prima oara semnam &#8220;.&#8221;<\/p>\n<pre>root@dns-s-1 named]# dnssec-keygen -a NSEC3RSASHA1 -b 2048 -n ZONE .\r\nGenerating key pair....+++ ...................+++\u00a0\r\nK.+007+64334\r\n[root@dns-s-1 named]# dnssec-keygen -f KSK -a NSEC3RSASHA1 -b 4096 -n ZONE .\r\nGenerating key pair...................................................++ ......................................................................................................................................................++\u00a0\r\nK.+007+28638\r\n\r\n[root@dns-s-1 named]# for key in `ls K*key`; do echo \"\\$INCLUDE $key\" &gt;&gt; named.ca ; done\r\n[root@dns-s-1 named]# cat named.ca\u00a0\r\n$TTL 3600\r\n@ \u00a0 \u00a0 \u00a0 IN\u00a0 \u00a0 \u00a0 SOA \u00a0 \u00a0 dns-s-1.root-servers.net.\u00a0 \u00a0 \u00a0 hostmaster.root-servers.net.\r\n(\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a02012071200 ; serial number YYMMDDNN\r\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 28800 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ; Refresh\r\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 7200\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ; Retry\r\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 864000\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ; Expire\r\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 3600 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ; Min TTL\r\n)\r\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 NS\u00a0 \u00a0 \u00a0 dns-s-1.root-servers.net.\r\n$ORIGIN .\r\ndns-s-1.root-servers.net. 3600 IN A 172.16.155.101\r\n$INCLUDE K.+007+28638.key\r\n$INCLUDE K.+007+64334.key\r\n\r\n[root@dns-s-1 named]# dnssec-signzone -A -3 $(head -c 1000 \/dev\/urandom | sha1sum | cut -b 1-16) -N INCREMENT -o . -t named.ca\r\n\r\nVerifying the zone using the following algorithms: NSEC3RSASHA1.\r\nZone fully signed:\r\nAlgorithm: NSEC3RSASHA1: KSKs: 1 active, 0 stand-by, 0 revoked\r\n\u00a0\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ZSKs: 1 active, 0 stand-by, 0 revoked\r\nnamed.ca.signed\r\nSignatures generated: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 10\r\nSignatures retained: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\r\nSignatures dropped:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\r\nSignatures successfully verified:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\r\nSignatures unsuccessfully verified:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\r\nSigning time in seconds: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0.022\r\nSignatures per second: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 447.407\r\nRuntime in seconds:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0.026<\/pre>\n<p>Modificam \/etc\/named.conf astfel:<\/p>\n<pre>zone \".\" {\r\n\u00a0 \u00a0type master;\r\n\u00a0 \u00a0file \"named.ca.signed\";\r\n};<\/pre>\n<p>Apoi restartam <strong>named<\/strong> si in loguri o sa zica urmatoarele (printre altele):<\/p>\n<pre>Mar 28 14:13:34 dns-s-1 named[2338]: zone .\/IN: loaded serial 2012071201 (<strong>DNSSEC signed<\/strong>)<\/pre>\n<p>Acum avem &#8220;.&#8221; semnat (self-signed ca e root, nu exista autoritate mai mare ca .)<\/p>\n<p style=\"text-align: justify;\">Dupa &#8220;.&#8221; urmeaza crearea unui TLD (Top Level Domain), si anume imacandi. Pentru asta adaugam urmatoarele inregistrari in zona &#8220;.&#8221;:<\/p>\n<pre>imacandi. IN NS ns1.dns.imacandi.\r\nns1.dns.imacandi. IN A 172.16.155.102<\/pre>\n<p>Acum ca zona a fost modificata, trebuie re-semnata si dupa aceea reincarcata de BIND.<\/p>\n<pre>dnssec-signzone -A -3 $(head -c 1000 \/dev\/urandom | sha1sum | cut -b 1-16) -N INCREMENT -o . -t named.ca\r\n[root@dns-s-1 named]# rndc reload\r\nserver reload successful<\/pre>\n<p style=\"text-align: justify;\">Acum trecem pe dns-s-2 si cream configurarile necesare pentru noua zona, chain of trust cu &#8220;.&#8221; si importul inregistrarilor de tip DS in &#8220;.&#8221;.<\/p>\n<p style=\"text-align: justify;\">In primul rand, modificam \/etc\/named.conf astfel:<\/p>\n<pre>trusted-keys {\r\n\".\" 257 3 7 \"AwEAAa8SV9IPDSXr+THXuogKOGxCvERdRf39cJ9spETd22AgVRYTI1Tr C57FXGtcC+tGa0AYs9chGsZ8eNwGD76YdnydD8CT+tLfokbVHih0ewQz RiobvXE4UY7HycrnC+ZY9yToM4ktKSsX1YWFsNGcIBn60c5J39LbAJ\/i bB2+TCvdJNE4jrHkP4pf\/onXJvG\/RMFllShMtmOqgn1y79yJGTwoO2ab Rbm4kV3qDKiLtfrmyLqJTGbKf+R98NTpe1ufPnQCDwV13xlNRlsok8Gz cFDjTNf6ZepQ2wF8CzpDYHK7\/tANCEFgR0vOzYkb8VkkaEzMUCYOveqp wy8e+isoDtoBA1e48awEYo3o+YN1DVEbCoR4Xbdy4cf+qkXv0nS8QNar 0RHSjghmsQddDVMoFaYLWv8lqSCd1uQufSnMd1okv3nEyKIwWBB3xG5r x7GJpqMtqA4BRWcv28tGgPkbFaWMkjVPqUIBgyk87fAB+a1H51uy0J1K Q+99U+8\/41m6mnNoa2kjxJL53dYcf0DO4eUgsRY2LcO6etk\/XbHm9\/+M GOfes0pmPJ8V3Yb2V1J5WV62sYaPrvw+jh3h2V5RvNW+QHZ6U5M73eWZ w8vYyygYl3sWHy03vX4mQnq2XsMJ0CDvR+XLWG98RpItYG65LwhiayRP +dDhJpSyOY3aeXLD\";\r\n};\r\nzone \"imacandi.\" IN {\r\n type master;\r\n file \"imacandi.\";\r\n };<\/pre>\n<p>In zona &#8220;imacandi.&#8221; se trec urmatoarele:<\/p>\n<pre>$TTL 3600\r\n@ \u00a0 \u00a0 \u00a0 IN\u00a0 \u00a0 \u00a0 SOA \u00a0 \u00a0 ns1.dns.imacandi. \u00a0 \u00a0 hostmaster.dns.imacandi. (\r\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 2012071203 ; serial number YYMMDDNN\r\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 28800 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ; Refresh\r\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 7200\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ; Retry\r\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 864000\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ; Expire\r\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 3600 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ; Min TTL\r\n)\r\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 NS\u00a0 \u00a0 \u00a0 ns1.dns.imacandi.\r\nns1.dns.imacandi. 3600 IN A 172.16.155.102\r\n$ORIGIN imacandi.\r\nsin IN NS dns1.sin.imacandi.\r\ndns1.sin IN A 172.16.155.103<\/pre>\n<p>Dupa ce avem configurata zona, trecem la crearea cheilor KSK si ZSK si dupa aia semnam zona.<\/p>\n<pre>[root@dns-s-2 named]# dnssec-keygen -a RSASHA256 -b 2048 -n ZONE imacandi.\r\nGenerating key pair.............+++ ....+++\u00a0\r\nKimacandi.+008+03645\r\n[root@dns-s-2 named]# dnssec-keygen -f KSK -a RSASHA256 -b 2048 -n ZONE imacandi.\r\nGenerating key pair.......................................................................+++ ..................+++\u00a0\r\nKimacandi.+008+35377<\/pre>\n<p>Adaugam cheile in fisierul de zona:<\/p>\n<pre>$INCLUDE Kimacandi.+008+03645\r\n$INCLUDE Kimacandi.+008+35377<\/pre>\n<p>Si semnam zona:<\/p>\n<pre>[root@dns-s-2 named]# dnssec-signzone -N INCREMENT -o imacandi. -t imacandi.\r\nVerifying the zone using the following algorithms: RSASHA256.\r\nZone fully signed:\r\nAlgorithm: RSASHA256: KSKs: 1 active, 0 stand-by, 0 revoked\r\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ZSKs: 1 active, 0 stand-by, 0 revoked\r\nimacandi..signed\r\nSignatures generated:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 8\r\nSignatures retained: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\r\nSignatures dropped:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\r\nSignatures successfully verified:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\r\nSignatures unsuccessfully verified:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\r\nSigning time in seconds: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0.009\r\nSignatures per second: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 833.159\r\nRuntime in seconds:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0.012<\/pre>\n<p>Dupa semnare, luam datele despre DS si le adaugam in zona parinte:<\/p>\n<pre>imacandi. IN DS 35377 8 1 16085596E91E80E95E70FA8EABE646A25499967E\r\nimacandi. IN DS 35377 8 2 818FB42E72B000DCD9621F9F78D85845C25BAC44566CD4B687543C1B A874B6C5<\/pre>\n<p>Si re-semnam zona parinte.<\/p>\n<p>Pe dns-s-3 am creat zona sin.imacandi.<\/p>\n<pre>zone \"sin.imacandi\" IN {\r\n type master;\r\n file \"sin.imacandi.signed\";\r\n };<\/pre>\n<p>Dupa aceea am creat cheile de semnare:<\/p>\n<pre>[root@dns-s-3 named]# dnssec-keygen -a NSEC3RSASHA1 -b 2048 -n ZONE sin.imacandi\r\nGenerating key pair............................................+++ ..................................+++\u00a0\r\nKsin.imacandi.+007+43763\r\n[root@dns-s-3 named]# dnssec-keygen -f KSK -a NSEC3RSASHA1 -b 4096 -n ZONE sin.imacandi\r\nGenerating key pair.......++ ................++\u00a0Ksin.imacandi.+007+02085<\/pre>\n<p>Le-am adaugat in zona si dupa am semnat zona:<\/p>\n<pre>[root@dns-s-3 named]# dnssec-signzone -A -3 $(head -c 1000 \/dev\/urandom | sha1sum | cut -b 1-16) -N INCREMENT -o sin.imacandi -t sin.imacandi\r\nVerifying the zone using the following algorithms: NSEC3RSASHA1.\r\nZone fully signed:\r\nAlgorithm: NSEC3RSASHA1: KSKs: 1 active, 0 stand-by, 0 revoked\r\n\u00a0\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ZSKs: 1 active, 0 stand-by, 0 revoked\r\nsin.imacandi.signed\r\nSignatures generated: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 12\r\nSignatures retained: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\r\nSignatures dropped:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\r\nSignatures successfully verified:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\r\nSignatures unsuccessfully verified:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\r\nSigning time in seconds: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0.022\r\nSignatures per second: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 543.084\r\nRuntime in seconds:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0.026<\/pre>\n<p style=\"text-align: justify;\">Iar pentru validare, in configuratia lui BIND am adaugat cheia pentru &#8220;.&#8221; pe dns-s-3 in named.conf:<\/p>\n<pre>trusted-keys {\r\n\".\" 257 3 7 \"AwEAAa8SV9IPDSXr+THXuogKOGxCvERdRf39cJ9spETd22AgVRYTI1Tr C57FXGtcC+tGa0AYs9chGsZ8eNwGD76YdnydD8CT+tLfokbVHih0ewQz RiobvXE4UY7HycrnC+ZY9yToM4ktKSsX1YWFsNGcIBn60c5J39LbAJ\/i bB2+TCvdJNE4jrHkP4pf\/onXJvG\/RMFllShMtmOqgn1y79yJGTwoO2ab Rbm4kV3qDKiLtfrmyLqJTGbKf+R98NTpe1ufPnQCDwV13xlNRlsok8Gz cFDjTNf6ZepQ2wF8CzpDYHK7\/tANCEFgR0vOzYkb8VkkaEzMUCYOveqp wy8e+isoDtoBA1e48awEYo3o+YN1DVEbCoR4Xbdy4cf+qkXv0nS8QNar 0RHSjghmsQddDVMoFaYLWv8lqSCd1uQufSnMd1okv3nEyKIwWBB3xG5r x7GJpqMtqA4BRWcv28tGgPkbFaWMkjVPqUIBgyk87fAB+a1H51uy0J1K Q+99U+8\/41m6mnNoa2kjxJL53dYcf0DO4eUgsRY2LcO6etk\/XbHm9\/+M GOfes0pmPJ8V3Yb2V1J5WV62sYaPrvw+jh3h2V5RvNW+QHZ6U5M73eWZ w8vYyygYl3sWHy03vX4mQnq2XsMJ0CDvR+XLWG98RpItYG65LwhiayRP +dDhJpSyOY3aeXLD\";\r\n};<\/pre>\n<p>Iar pe dns-s-2 am adaugat inregistrarile de tip DS si am resemnat zona imacandi.:<\/p>\n<pre>sin.imacandi. IN DS 2085 7 1 E1B11E776525C73D7E7484817F57F4F9BDDFAB53\r\nsin.imacandi. IN DS 2085 7 2 FC19462CA30C80691DAF2FFB6847130F7384BB9DAA82199FFDA60415 90976C45<\/pre>\n<p style=\"text-align: justify;\">Acum situatia este in felul urmator:\u00a0dns-s-1 este autoritativ pentru &#8220;.&#8221; si contine inregistrari de tip DS pentru &#8220;imacandi.&#8221;, dns-s-2 este autoritativ pentru &#8220;imacandi.&#8221; si contine inregistrari de tip DS pentru &#8220;sin.imacandi.&#8221;, dns-s-3 este autoritativ pentru &#8220;sin.imacandi.&#8221; si contine inregistrari de tip A pentru teste.<\/p>\n<p style=\"text-align: justify;\">Un query recursiv pe dns-s-2 pentru un host numit bumblebee.sin.imacandi. care este definit in zona de pe dns-s-3 arata asa:<\/p>\n<pre>[root@dns-s-3 named]# dig +dnssec -t A bumblebee.sin.imacandi. @172.16.155.102 +multiline\r\n; &lt;&lt;&gt;&gt; DiG 9.9.4-RedHat-9.9.4-14.el7_0.1 &lt;&lt;&gt;&gt; +dnssec -t A bumblebee.sin.imacandi. @172.16.155.102 +multiline\r\n;; global options: +cmd\r\n;; Got answer:\r\n;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 14987\r\n;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 1\r\n;; OPT PSEUDOSECTION:\r\n; EDNS: version: 0, flags: do; udp: 4096\r\n;; QUESTION SECTION:\r\n;bumblebee.sin.imacandi. IN A\r\n;; ANSWER SECTION:\r\nbumblebee.sin.imacandi. 3521 IN A 172.16.155.104\r\nbumblebee.sin.imacandi. 3521 IN RRSIG A 7 3 3600 (\r\n20150427161417 20150328161417 43763 sin.imacandi.\r\nE9AQRx+ns1ZrmoPw+TduURzS8cGBAftivGEBBh1W75\/u\r\nyZ24tGQQ6bmmYQK84YO39qj2JDLANH06212Co0\/emBjJ\r\nUg\/\/YU+06nwT\/fRu8vp\/VL1u\/8F3rSAGT5KSai1cFnjM\r\nTt\/c+urWzAmw9CzxwBO4QE9NCth8jT35tblfUSuTN0xy\r\nlOeTnTPqXvyTYNRm0HxygqIgEDC4K3PdDbZbYAT02djj\r\n\/S8upDBZydJb3KuuHRvIZ6n4k0SKAyKChdCABFEGgM\/M\r\nqPozD0gU52nYuUlR0fbfY844eqQfnRMNJvfIcY3xYb3h\r\nyidsFSwqgxs0vynCriefAVu\/IxpAptlHpw== )<\/pre>\n<p style=\"text-align: justify;\">Important este flag-ul AD din raspuns care inseamna Authenticated Data, asta inseamna ca serverul care raspunde poate verifica tot lantul si &#8220;chain of trust&#8221; este intact.<\/p>\n<p style=\"text-align: justify;\">Mai sunt cateva aspecte pe care intentionez sa le exemplific intr-un post urmator candva:<\/p>\n<ul>\n<li style=\"text-align: justify;\">semnare automata a zonelor<\/li>\n<li style=\"text-align: justify;\">pentru paranoici: interfatarea cu un HSM si stocarea cheilor private pe el<\/li>\n<li style=\"text-align: justify;\">update-ul automat al zonelor + semnarea automata<\/li>\n<\/ul>\n<p>Cam asta e din categoria ce mai face sin sambata cand ploua afara :)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>DNS-ul este unul din protocoalele care reprezinta coloana verterbrala a Internetului. Cand a fost inventat, securitatea nu a fost luata in calcul pentru ca s-a mers pe ideea ca toti utilizatorii o sa fie cinstiti, lucru care s-a dovedit un pic fals. DNS-ul a fost abuzat de tot felul de oameni pentru diverse scopuri, mai &hellip; <a href=\"https:\/\/www.imacandi.net\/sin\/blog\/2015\/03\/28\/dnssec-1.html\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">dnssec (1)<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"ngg_post_thumbnail":0,"footnotes":""},"categories":[2],"tags":[7],"class_list":["post-4426","post","type-post","status-publish","format-standard","hentry","category-diverse","tag-computers"],"_links":{"self":[{"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/posts\/4426","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/comments?post=4426"}],"version-history":[{"count":8,"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/posts\/4426\/revisions"}],"predecessor-version":[{"id":4435,"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/posts\/4426\/revisions\/4435"}],"wp:attachment":[{"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/media?parent=4426"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/categories?post=4426"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/tags?post=4426"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}