DNSECWITHGTMv2.0_EN_part1

13
DNSSEC-trust chain
root . DS of com. DNSKEY(ksk,zsk)
Ldns Has ksk of root.
.com. DS of DNSKEY(ksk,zsk)
DNSKEY(KSK,ZSK) DS of subdomain(sub.dnssecc )
5
Cache poisoning

?
ቤተ መጻሕፍቲ ባይዱ
?
012.012.012.012 LDNS
123.123.123.123
GSLB
App Servers
Spoofing with first response
Hacker
Cache poisoning
DNSSEC AND GTM
Lin Jing 2011/7/17
2
Version history
Ver V1.0 V1.1 V2.0 V2.1 Author Lin jing Linjing Linjing Linjing Date Note 2011.7.17 Initial version 2011.7.18 Minor change, Add current dnssec status of the world 2011.7.31 Add DLV ,in another ppt 2012/12/1 Add something not so important 2
14
How to configure NS which support DNSSEC
• • • • • • • • • BIND9.6+, recommend 9.7 +, and should compile with openssl 1.Create KSK and ZSK dnssec-keygen -a DSA -b 1024 -n ZONE dnssec-keygen -a DSA -b 1024 -n ZONE -f KSK We can put the keys into the same folder with zone files 2、Edit zone file to include public keys of KSK and ZSK： $include **.key 3.Sign zone, It will be generating adn.ent.signed file root@bind:/etc/bind# dnssec-signzone -t -k .+003+61822 -o .+003+04739 • 4.Add dnssec-enable yes; into option sector of named.conf file • 5.Edit named.conf,Change zone file name to the signed zones file
10
DNSSEC theory
• Within DNSSEC, clients will not make any decision, clients just say he can accept dnssec security RRs, there will be a record type named OPT in dns request. • Recursive NS will authenticate response and make decision if the answer is correct. • Recursive NS will set AD flag which in response if the answer is correct and can be believed, otherwise will respond server fail to clients.
15
Example of Name server
• Refer to Slide memo
16
Set a recursive server which support DNSSEC
• Most of LDNS now don’t support dnssec. So we need set a ldns for test. • Add below into option sector of named.conf • recursion yes; • dnssec-enable yes; • dnssec-validation yes; • After bind v9.7, BIND will use a key file which include root key if enable dnssec-validation, the file name maybe named bind.keys (Depend on system)
4
Why do we need DNSSEC
• The current DNS architecture is not security, Clients(resolver) can’t check if the answer is spoofed • Recursive server cache poisoning is a typical case. • DNSSEC can verify if the answer originate from authoritative server, and can verify that responses are not modified, also can secure denial of existence. • But DNSSEC doesn’t prevent the DNS DOS attack.
Problem
Need to secure DNS infrastructure
• • Cache poisoning and spoofing can hijack DNS records Need a method for trusted responses
6
Status of TLD DNSSEC
11
DNSSEC authentication process
• ZSK will sign zones, so theoretically we can authenticate response once we have public key of ZSK. • How to get public key of ZSK? It is in DNSKEY RR, we can send DNSKEY type request just like sending a A type request. • But how to identify this ZSK? Is it the issue of eggs and chickens? So we need KSK to authenticate ZSK. • But how can we get KSK and how do we know KSK is not corrupted? • --We get KSK from DNSKEY type RR. • --We need first trust the KSK, so KSK should be got through a safe way. At this time, KSK is a trust anchor for clients.
12
DNSSEC-trust chain
• So we just need to get KSK safely, then we can validate answers • But there are so many domain in the world, we can’t get all KSKs of these domains. So if we trust only one domain, then the thing will be easy, so trust the root is a good way. • TLDs will submit its DS to root • Second domains will submit their DS to TLDs • DS is hash of KSK, so KSK can be validated by DS • So I we trust root, then we can validate KSK of TLDs by DS which in root, if TLDs answer is validated ,then we can use DS which in TLDs to validate KSK of second domains. • If KSK of second domains is validated, then we can authenticate ZSK by KSK, after ZSK is validated we will authenticate RR by ZSK. • The above whole steps build a trust chain.
3
What is DNSSEC
• DNSSEC- Domain name system Security Extensions • RFC 2535 Domain name system Security Extensions （deprecated） • RFC4033 4034 4035 for DNSSEC • RFC 4641 DNSSEC Operational Practices
7
Trend of TLD DNSSEC deployment
8
How about DNSSEC of TLD
• /