Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
DNSSEC and Bind
Search
Chinmay Pendharkar
May 21, 2014
Technology
1
110
DNSSEC and Bind
Basics of DNS and DNSSEC. Setting up Bind locally.
Chinmay Pendharkar
May 21, 2014
Tweet
Share
More Decks by Chinmay Pendharkar
See All by Chinmay Pendharkar
Audio Fundamentals - Pd
notthetup
0
64
Garageband And Podcasting
notthetup
0
35
Audio Fundamentals - HTML5 Audio
notthetup
0
80
Audio Fundamentals - Oscillators
notthetup
0
44
Audio Fundamentals - Basics
notthetup
0
80
Robots and Pi
notthetup
2
120
Auralization of road vehicles using spectral modeling synthesis
notthetup
0
130
What I’ve learnt about Environmental Sound Design
notthetup
0
160
Audio Editing with Audacity
notthetup
0
39
Other Decks in Technology
See All in Technology
AWSでRAGを作る法方
sonoda_mj
1
140
dxd2024-生成AIに振り回された3か月間の成功と失敗/dxd2024-link-and-motivation
lmi
2
260
OSSコミットしてZennの課題を解決した話
dyoshikawa1993
0
150
Datadog Cloud SIEMを使ってAWS環境の脅威を可視化した話/lifeistech-datadog-cloud-siem
gidajun
0
480
たくさん本を読んだけど 1年後には綺麗サッパリ!を乗り越えて 学習の鬼になるぞ👹
yum3
0
160
Luupの開発組織におけるインシデントマネジメントの変遷 ver.RoadtoSRENEXT2024
grimoh
1
270
【基調講演】変える、今ここから ― IoTとAIで紡ぐ未来
soracom
PRO
0
320
シフトレフトで挑む セキュリティの生産性向上
sekido
PRO
0
270
Classmethod流のPlatform Engineering / classmethod-platform-engineering-devio2024
tomoki10
0
480
頼られるのが大好きな 皆さんへ - 支援相手との期待の合わせ方、突き放し方 -/For_people_who_like_to_be_relied_on
naitosatoshi
1
290
テストケースの自動生成に生成AIの導入を試みた話と生成AIによる今後の期待
shift_evolve
0
190
20240724_cm_odyssey_hibiyatech
hiashisan
0
110
Featured
See All Featured
The Brand Is Dead. Long Live the Brand.
mthomps
52
36k
Understanding Cognitive Biases in Performance Measurement
bluesmoon
18
1.2k
Put a Button on it: Removing Barriers to Going Fast.
kastner
58
3.3k
The Invisible Side of Design
smashingmag
294
50k
Stop Working from a Prison Cell
hatefulcrawdad
266
20k
Writing Fast Ruby
sferik
623
60k
Docker and Python
trallard
37
2.9k
Infographics Made Easy
chrislema
238
18k
Scaling GitHub
holman
458
140k
Easily Structure & Communicate Ideas using Wireframe
afnizarnur
189
16k
The Invisible Customer
myddelton
117
13k
What’s in a name? Adding method to the madness
productmarketing
PRO
21
2.9k
Transcript
DNSSEC + Bind Chinmay Pendharkar
Disclaimer - Crypto Noob! - Developer ==> Please correct me
if I’m wrong!
What shall we talk about? - DNS - DNSSEC
What is DNS? - Domain Name System - Translate URLs
to IP Addresses (and more) www.google.com => 74.125.135.147
Why? Humans like letter addresses (URLs) - www.google.com Computers prefers
numbers - 74.125.135.147
How does it work?
No really... - UDP - User Datagram Protocol (mostly) -
Me - Q: “What’s the IP for www.google.com” - DNS - A: “74.125.135.147”
In Action
Actual Response
Who is this DNS you speak of?
Nameservers!
Iterative query + Caching
Everything is AWESOME! NOT SO FAST!!!
DNS has issues. - No guarantee that you’re talking to
a authentic name server - Me - Q: “What’s the IP for www.google.com” - Evil ISP Server - A: 1.0.0.1
How? Send a request generally in the direction of the
assigned DNS name server. Anyone in between can respond to that query!!
DNS has more issues DNS Responses can be tampered with
in flight. - Me - Q: “What’s the IP for www.google.com” - DNS Nameserver - A: “74.125.135.147” - Evil ISP Server - A: “74.125.135.148”
DNSSEC to the Rescue Domain Name System Security Extensions “provide
origin authentication, authenticated denial of existence, and data integrity”
But how?? “digitally signing records for DNS lookup using public-key
cryptography” “authenticated via a chain of trust” “you trust the root, then use the root to verify the rest of the chain”
None
Example Requesting IP of bursar.university.edu
Setup for Domain owners. - generate own public/private key pair.
- upload public key to registrar, - registrar pushes the keys via secDNS to the zone operator (e.g.: Verisign for .com) - zone operator signs and publishes them in DNS.
What if my registrar/root doesn’t DNSSEC? - DNSSEC Lookaside Validation
- Internet Systems Consortium DLV Registry. - an additional entry point (besides the root zone) to obtain DNSSEC validation information
How can I use this stuff? We need. 1. A
Name server that speaks DNSSEC 2. All clients speak DNSSEC
#2
What can we do? Run our own Name server!
But but but... HTTP Stack -> Local Name server (DNS)
Local Name server Server -> DNS (DNSSEC)
Introducing... BIND - Berkeley Internet Name Domain - Default Name
server software used by many
Get bound? http://www.bind9.net/ Your favourite package manager should have it
apt-get bind9; pacman -S bind9 port install bind9
Configure bind - Linux : http://haller.ws/projects/bind/dnssec/ - OSX: https://gist.github. com/notthetup/5381693
- Win: http://alex.charrett.com/bind-on-windows
What are we doing? - Generate and verify DNSSEC root
key - Generate and verify DLV key - Add the keys into bind configuration - Enable DNSSEC in bind configuration dnssec-enable yes; dnssec-validation yes; dnssec-lookaside "." trust-anchor dlv.isc.org.;
Setup Bind Make sure it only listens to YOU! listen-on
{ 127.0.0.1; }; Run Bind as a Daemon. sudo launchctl load -w /System/Library/LaunchDaemons/org.isc.named.plist
Use Bind Use Bind as your default DNS Server instead.
Now you can haz DNSSEC
Has it worked out? - No noticeable delay in queries.
- No noticeable increase in CPU usage. - Rare domains don’t work (yimg/yahoo WTH??)
Go get your DNS SEC today!