Resolver新网dns

thisprintforcontentonly—size&colornotaccuratespine=1.
146"608pagecountBOOKSFORPROFESSIONALSBYPROFESSIONALSProDNSandBINDDearReader,Everytimeyoureceivee-mailoraccessawebpage,youusetheDomainNameSystem(DNS).
ThatmakesDNScriticaltotheoperationoftheglobalInternet.
However,thisbookisnotatheoreticalworkaboutglobalconcepts.
Itisaboutpractical,real-worldsolutions.
EveryoneofthoserequestsoriginatefromaDNSthatsupportsagroupoflocalusers,andeveryoneofthemisfinallyansweredbyaDNSserverthatmaysupportahighvolumecommercialwebsiteoramodestpersonalmailserver.
Thisbookisaboutunderstanding,configuring,diagnosing,andsecuringtheselocalDNSserversthatdothevitalwork.
Ihavebeeninthecommunicationsbusinessasaprogrammer,designer,andsystemsadministratorforover30years.
Manyyearsago,whenIsetupmyfirstpairofDNSservers,Iwastedtimesearchingforsomepracticaladviceandsensibledescriptionsofthetheoryinvolved.
Ifoundneither.
IcompletedtheDNSrite-of-passage—thisbookwasbornfromthatexperience.
DNSisacomplexsubject,butitisalsounnecessarilycloakedinmysteryandmythology.
Thisbook,Ihope,isasensibleblendofpracticaladviceandtheory.
Youcantreatitasasimplepaint-by-numbersguidetoeverytaskfromasimplecachingDNStothemostcomplexsecureDNS(DNSSEC)implementations.
Butthebackgroundinformationishereforthosetimeswhenyounotonlyneedtoknowwhattodo,butyoualsoneedtoknowwhyyouaredoingitandhowcanyoumodifytheprocesstomeetyouruniqueneeds.
Yourssincerely,RonAitchisonUS$44.
99ShelveinNetworking/InternetUserlevel:Beginner–IntermediateAitchisonTHEEXPERT'SVOICEINOPENSOURCERonAitchisonProDNSandBINDCYANMAGENTAYELLOWBLACKPANTONE123CVISBN1-59059-494-0978159059494054499689253594940www.
apress.
comSOURCECODEONLINEforums.
apress.
comFORPROFESSIONALSBYPROFESSIONALSJoinonlinediscussions:THEAPRESSROADMAPTheDefinitiveGuidetoLinuxNetworkProgrammingBeginningSUSELinux:FromNovicetoProfessionalFromBashtoZShell:ConqueringtheCommandLineAutomatingUNIXandLinuxAdministrationProOpenSSHProDNSandBINDCoversDNSSEC.
bis!
CoversDNSSEC.
bis!
ProDNSandBINDApressispleasedtopresentanexcerptfrom:ProDNSandBINDRonAitchisonBookInformationProDNSandBIND|RonAitchisonPublished:August2005|ISBN:1-59059-494-0|$44.
99US|608pagesAboutApressAllApresstitlesareavailableatyourfavoriteonlineandbrickandmortarbookstores.
ContactApressatsales@apress.
comwithanyquestions.
ApressInc.
,basedinBerkeley,California,isthefastest-growingpublisheroftechnicalbooksintheworldtoday.
ItisdedicatedtomeetingtheneedsofITprofessionals,fromnovicetoexpert.
Apressisdedicatedtopublishingtitlesofthehighestqualityandhascompiledateamofauthorsthatisa"Who'sWho"ofthehigh-techindustry.
ContentsataGlanceAbouttheAuthorxxiAbouttheTechnicalReviewerxxiiiAcknowledgmentsxxvIntroductionxxviiPART1sssPrinciplesandOverviewsCHAPTER1AnIntroductiontoDNS.
3sCHAPTER2ZoneFilesandResourceRecords21sCHAPTER3DNSOperations.
39sCHAPTER4DNSTypes.
61sCHAPTER5DNSandIPv6.
77PART2sssGetSomethingRunningsCHAPTER6InstallingBIND.
95sCHAPTER7BINDTypeSamples121sCHAPTER8CommonDNSTasks155sCHAPTER9DNSDiagnosticsandTools.
183PART3sssDNSSecuritysCHAPTER10DNSSecureConfigurations235sCHAPTER11DNSSEC283PART4sssReferencesCHAPTER12BINDConfigurationReference.
331sCHAPTER13ZoneFileReference405iv4940fm_final.
qxd7/8/052:42PMPageivsCONTENTSATAGLANCEvPART5sssProgrammingsCHAPTER14BINDAPIsandResolverLibraries.
475sCHAPTER15DNSMessagesandRecords507PART6sssAppendixessAPPENDIXADomainNameRegistration.
533sAPPENDIXBDNSRFCs541sINDEX5474940fm_final.
qxd7/8/052:42PMPagevareliableprocessisinplacetogetfeedback.
Theconsequencesofre-signingtooearlywithonlythenewKSKarealsosevere,andagain,unlessthereisapressingreasonsuchasKSKcompromisewithactivedamageoccurring,itisbettertowait.
DNSSECLookasideValidationTheDNSSECLookasideValidation(DLV)serviceisanalternativemethodbywhichachainoftrustmaybecreatedandverifiedwithouttheneedtosigntheparentzonefile.
Theserv-icemakesuseofaDLVRR,whichisnotcurrentlydefinedbyanRFC—itsstatusisthereforeexperimental—butwhichisfullysupportedbythecurrent(9.
3+)versionsofBIND.
TheDLVRRisfunctionallyidenticaltotheDSRRandmaybegeneratedbythednssec-signzoneutil-itybyuseofthe-ldomain-nameoption(seeChapter9).
ADLVRRisplacedinaspecialsignedzonecalledalookasidezoneinsteadoftheDSRRthatwouldnormallybeaddedtotheparentzone,thusremovingtheneedtosigntheparentzone.
TheDLVserviceworksbyprovidinganalternativemethodtoverifyachainoftrustasdescribednext.
Assumethatthelookasidedomainiscalleddlv.
example.
netandthenameserveristryingtoverifythechainoftrustforthesignedzoneexample.
com.
Inanormalsequence,whenasecu-rity-awarenameservertriestoverifythechainoftrustforexample.
com,itwillfirstcheckforatrustedanchorinitstrusted-keysclause,andifoneisnotfound,itwillissueaquerytofindaDSRRattheparent.
comzone.
Ifneitherisfound,thezonewillbemarkedasinsecure.
DLVaddsanadditionalstepbyallowingthenameservertoqueryalookasidezone,forwhichitmusthaveatrustedanchor,fortheDLVRRofthezonebeingverified.
Whentheverifyingnameserverdetectsthatthelookasidefeatureisenabled(byadnssec-lookasidestatementinnamed.
conf),itwillissueaDLVquerywiththedomainnameexample.
com.
dlv.
example.
net,which,iffound,andassumingthetrustedanchorfordlv.
example.
netispresentinatrusted-keysclause,theexample.
comzoneisverifiedtobesecure.
Figure11-7illustratestheDLVprocess.
TheinitialquerywilltrytofindaDSRRforexample.
comattheparent.
comzoneandonlyifthatfailswilltheDLVquerybeissuedtothelookasidezone.
WhilethelookasidezoneCHAPTER11sDNSSEC323Figure11-7.
DLVverificationprocedure4940c11_final.
qxd7/8/052:14PMPage323dlv.
example.
netmustbesigned,thetrustedanchoratNS1meansthatitsparent,example.
net,doesnothavetobesigned,asisshowninFigure11-7.
ApublicpilotofDLViscurrentlybeingrunbyVeriSignLabs,adivisionofVeriSign,Inc.
(www.
verisignlabs.
com),whichcoversalloftheTLDswithasingletrustedanchor,withouttheneedforanyoftheTLDzonestobesigned.
DLVConfigurationThissectiondescribesthevariousstepstobetakenwhenjoiningthezoneexample.
comtoaDLVchainoftrust.
WhilethespecificexampleoftheVeriSignPilotisused,theexplanationscoverthegeneralcasewhereverappropriate.
ThelookasidezonefortheVeriSignPilotisdlv.
verisignlabs.
com.
TheDLVsystem,likeallotherDNSSECsystems,startswithasignedzone.
Theexample.
comzoneissignedinthenormalwayasdescribedearlierusingthednssec-signzoneutilitywiththeadditionofa-ldlv.
verisignlabs.
comoptiontocreateaDLVRRwiththecorrectname(example.
com.
dlv.
verisignlabs.
com).
CreationofthisDLVRRistheonlyreasonthezoneneedstobere-signed.
ThisstepisactuallynotrequiredforthecurrentVeriSignPilotproject,whichcreates'theDS'RRautomaticallywhenazoneissubmittedforadditiontothepilotproject.
Theprocessisdescribedinfull,sinceotherDLVservicesmay,however,requireaDLVRRtobesupplied.
AssumingthesameconfigurationasthelastexamplebutusingonlythenewKSKfromtherollover(key-tagis50148),thezonesigningwouldusethefollowingcommand:#dnssec-signzone-oexample.
com-t-ldlv.
verisignlabs.
com\-kKexample.
com.
+005+50148master.
example.
comKexample.
com.
+005+39539master.
example.
com.
signedSignaturesgenerated:20Signaturesretained:0Signaturesdropped:0Signaturessuccessfullyverified:0Signaturesunsuccessfullyverified:0Runtimeinseconds:0.
357Signaturespersecond:53.
079Asnotedpreviously,joiningtheVeriSignPilotdoesnotrequireaDLVRR,andsincethisistheonlyreasonforre-signingthezone,itmaybeomittedifthatistheonlyobjective.
The\indicatesthatthelinehasbeensplitforpresentationreasonsonly,meaningthefirstandsecondlinesactu-allyappearasasinglelinetotheoperatingsystem.
The-ldlv.
verisignlabs.
comargumentdefinesthenameofthelookasidezonethatwillbeappendedtothiszonename(definedbythe-oexample.
comargument)whentheDLVRRiscreated.
Thisoptioncausesdnssec-signzonetocreateanewfilecalleddlvset-example.
com.
,whichcontainsaformattedDLVRRasshownhere:example.
com.
dlv.
verisign.
com.
INDLV5014851(0CAE34DC1BDE4A5D12A777A8DEC3B703E516DC71)ThisDLVhasbeeneditedtousemultiplelinesusingthenormalzonefilemethodofenclosinginparenthesesforpresentationreasonsonly,andfrominspectionandcomparisonwiththeDSRRfromthepreviousexamplefiles,itmaybeseentobefunctionallyidentical.
CHAPTER11sDNSSEC3244940c11_final.
qxd7/8/052:14PMPage324Dependingontheoperationalorbusinessrequirementsofthelookasidezoneserviceoperator,theDLVRRmayneedtobesentbyasecureprocess.
Whilethedataitselfisnotsensitive,securetransmissionallowstherecipienttoauthenticatethesender,notjustthedata.
InthecaseoftheVeriSignPilot,theDLVRRissynthesizedwhenthezoneisregisteredontheproject'ssecurewebsite(https://www.
dlv.
verisignlabs.
com).
ThesubmittedzoneisinspectedbyVeriSignsoftwarebyqueryingforDNSKEYRRsatthezoneapex,anditwillautomaticallycreateandaddtoitsdatabaseaDLVRRforanyDNSKEYRRwithaflagsfieldvalueof257(theSEPorKSKbitisset).
Thistypeofproceduremayormaynotbecomecommonpractice,butitcertainlydemonstratesalevelofautomationthatwouldalsobepracticalforDSRRs.
sNoteTheVeriSignPilotrequiresthattheDLVRRpointstoaKSK;thatis,theDNSKEYRRhasaflagsvalueof257asdescribedearlier(theSEPbitisset)—thereforeaseparateKSKandZSKarerequiredpertherecommendedpractice.
ToconfigurethenameservertousetheDLVservicerequirestwochangestothenamed.
conffile.
Thefirstinvolvesdefinitionofthelookasidezonename(inadnssec-lookasidestatement),andthesecondrequirestheinclusionofatrustedanchorfortheDLVzone.
Thetrustedanchorforthepilotproject(atthetimeofwritingthereweretwosuchanchors)maybeobtainedfromhttps://www.
dlv.
verisignlabs.
com/trusted.
html.
Thisisasecurewebpage,andusersarerecommendedbytextonthepagetoverifythesecuritycertificate—asimplebuteffectiveauthenticationprocess—beforeusingthepublickeysdefined,whichmaybesimplycutandpastedintothenamed.
conffileasshowninthefollowingfragment://named.
confDLVfragment.
.
.
options{.
.
.
.
dnssec-lookaside".
"trusted-anchor"dlv.
verisignlabs.
com";.
.
.
.
};trusted-keys{dlv.
verisignlabs.
com.
25735"AwEAAbw2HZErA6PpTSVdEbdvY1I1ly3gTFAhJPAsC7oatIr/P3hDqz7sUjDy4rVHQPNjKvQMv2v0AqTyrykry02l9WGmbKZjsXyK219AiAHvSC44TsiskIN8IP28KkM1CWg+108FbPJGVbZ3OH1leRapnCCi2Z5q0dhecgFQWag/FupHoqN7snieYsUdby/9ZO9dLDdQeL9xJn1CVtiMcxfB5/juKJ/V9bF7WIsdLKlootqniS42cjsyGGwxsfZxHQ3mH/GOdf1KnGs8ENBnpxSytJk4q0gYP5AkNAPTG0j1Kdma2f9vi6wZAIYVkcQPKusBTYbUclFrIXnKGtPHH3Cny1s=";dlv.
verisignlabs.
com.
25735"AQPAQR5KGn12Q/IPhkGMv6ZlAI57rw44/7csvZjuOvWDbFuOG0CwwiRVa7FTh2MQIkCgUjqJ2ZTKTAyBMSadqFoVCc/CI6CFuQN+inmNNkGZsn5lE8qIoJkMIyl+/v0/0whLOCurFh0buyNJKouKqoO9wi3p0KrWQRkbnLWlcqeqfsANCHAPTER11sDNSSEC3254940c11_final.
qxd7/8/052:14PMPage325Gpxi27TveSm3x3pS8f9ZXHQvz5yFethXitHDQuYl+apFODsZ/TfXE9dl7+oR+5hzbzIMbPBByuqna4/ZFCcwJL2WhEArHFQSpkzUaVX2ugBZ48H0M9XqG8aUCkElRAkxrawf5x3bm6y3UmoQPvTQL8T71BZ6Cku84FyDGUoh";};TheVeriSignDLVPilotprovidessupporttocoverthewholehierarchyofthedomainnametotherootandthereforerecommendsadnssec-lookasidestatementwitha.
(root)domainasshownintheprecedingexample.
TheeffectofthisdefinitionisthateverysecurezoneforwhichthereisnoparentDSRRandnotrustedanchorwillincuraDLVquerytothedomaindlv.
verisignlabs.
com,whichmaybeanunacceptableoverhead.
Iftheuserwantstolimitthisprocesstoonlythe.
comdomain,thefollowingalternativestatementcouldbeused:dnssec-lookaside".
com"trusted-anchor"dlv.
verisignlabs.
com";Inthiscase,onlydomainnamesendingwith.
comwillincuraDLVlookup.
Similarly,thiscouldhavebeenlimitedto.
ator.
orgdomainsormultiplednsssec-lookasidestatementsusedtoselectonlythe.
deand.
orgdomains,dependingonrequirement.
Thetrustedanchornameofdlv.
verisignlabs.
comisuniquetothecurrentVeriSignPilotprojectandreferencesentries(intheprecedingcasetwo)inthetrusted-keysclausewiththesamename.
DLVServiceThereisnothingmagicalaboutaDLVservice.
ADLVserviceusesastandardnameserverwithastandardsignedzonefileandcouldbecreatedforusebyanyaffinitygroupasanalternativetomultipletrustedanchorsforeachmemberofthegroup.
ToillustratecreationofaDLVservice,assumeanaffinitygroupcomprisedofthedomainsexample.
org,example.
com,andexample.
netdecidetosetupaDLVservicethatwillhostedbydlv.
example.
com.
Intheabsenceofanyspe-cialsoftwareasusedbytheVeriSignLabsPilot,eachmemberdomainwillcreateaDLVRRbythezonesigningprocessdescribedusinga-ldlv.
example.
comargument.
TheDLVRRsaresenttothedomainadministratorfordlv.
example.
combyaprocessthatwillauthenticatethesender,suchassecuree-mail.
AzonefilecomprisingthesuppliedDLVRRswillbecreatedasshownhere:;zonefragmentfordlv.
example.
com$TTL1d;zonedefault$ORIGINdlv.
example.
com.
@INSOAns1.
dlv.
example.
com.
hostmaster.
dlv.
example.
com.
(2005032902;serial10800;refresh(3hours)15;retry(15seconds)604800;expire(1week)10800;minimum(3hours))NSns1.
dlv.
example.
com.
NSns2.
dlv.
example.
com.
ns1A192.
168.
254.
2ns2A192.
168.
254.
3;DLVRRsforaffinitygroupCHAPTER11sDNSSEC3264940c11_final.
qxd7/8/052:14PMPage326example.
com.
dlv.
example.
com.
INDLV3755851(CCCCCCCCCCCC)example.
org.
dlv.
example.
com.
INDLV4213451(DDDDDDDDDDD)example.
net.
dlv.
example.
com.
INDLV0255751(EEEEEEEEEEEEE).
.
.
.
AZSKandKSKforthedlv.
example.
comzonewillbecreatedusingthednssec-keygenutilityandaddedtothezonefileasdescribedearlier,andthezonewillbesignedwiththednssec-signzoneutilityusingbothKSKandZSKasnormal.
ThepublickeyoftheKSKfordlv.
example.
comisdistributedtobeusedasatrustedanchorbyallthemembersoftheaffinitygroup;thusasingletrustedanchorisusedtoreplacethealternativeofthreetrustedanchors,whichwouldotherwiseberequired.
Thezonedlv.
example.
comwouldbedelegatedfromexample.
comandanauthoritative-onlynameserver(seeChapter7)createdtosupporttheservice.
Finally,eachmemberwouldaddthetrustedanchorfordlv.
example.
cominatrusted-keysclauseintheirnamed.
conffile,andtoinvoketheserviceeachmemberwouldfurtheraddthefollowingthreelinestotheoptionsclauseinthesamenamed.
conffile:dnssec-lookaside"example.
com"trusted-anchor"dlv.
example.
com";dnssec-lookaside"example.
net"trusted-anchor"dlv.
example.
com";dnssec-lookaside"example.
net"trusted-anchor"dlv.
example.
com";Thespecificationofdnssec-lookasidesaysthatanydomainatorbelowthedefineddomainnamewillusethelookasidezonedefinedinthetrusted-anchoroption,whichmeansthatonlydomainnamesendingwithexample.
com,example.
org,orexample.
netwillincuraDLVlookup.
However,thespecificationalsosaysthatthedeepestdomainname(whichactuallymeanstheonewiththemostlabels)definedinadnssec-lookasidewillbeusedforthelookasidequery.
Soifanameserverthatincludedthepreviousthreelinesalsowishedtouse,say,theVeriSignDLVPilotservice,itwouldaddthefollowingstatementtoinvokethatDLVservice:dnsssec-lookaside".
"trusted-anchor"dlv.
verisignlabs.
com";Theeffectofthisstatementwouldbethatanysecuredomainthatdoesnotendwithexample.
com,example.
org,orexample.
netwouldincuraDLVlookuptothedlv.
verisignlabs.
comlookasidedomain,whereasonlyourthreetargetdomains,example.
com,example.
net,andexample.
org,wouldquerythedlv.
example.
comlookasidedomain.
Itisthereforepossibletosup-portanumberofconcurrentDLVservices,eachofwhichmaytargetspecificmarketsoraffinitygroupspriortothewidespreadavailabilityofsignedTLDs.
SummaryThischapterdescribesthetheoryandimplementationofDNSSEC(colloquiallyknownasDNSSEC.
bis),whichrepresentsthesecondgenerationofstandardsusedtoensuretheauthen-ticityandintegrityofdatasuppliedfromasuitablyconfiguredauthoritativenameservertoasecurity-awarerequestingnameserver.
DNSSECstandardsusepublickey(asymmetric)cryp-tographytoensurethatthedatasuppliedinresponsetoaqueryfor,say,www.
example.
com,couldonlyhavecomefromthedomainexample.
com(authenticity),thatdatareceivedbythequeryingnameserveristhesameasthedatasentbythequeriednameserver(dataintegrity),andthatintheeventwww.
example.
comdoesnotexist,itcanbeproventhatsuchisthecaseCHAPTER11sDNSSEC3274940c11_final.
qxd7/8/052:14PMPage327(proofofnonexistenceordenialofexistence).
Transactionsecurity,usedtosecureoperationssuchasDDNSorzonetransfer,iscoveredinChapter10.
Thechapterdescribedtheestablishmentofislandsofsecuritywherebysingle,uncon-nectedzonesmaybesecured,oragroupofsuchisolatedislandsthatarepartofanaffinityorcommoninterestgroup,suchasanenterprisenetwork,maybesecured.
Inthiscase,togetsecuritycoveragethezonerequiresatrustedanchor—thepublickeyusedtosignthesecuredzone—whichisobtainedbyasecureprocessthatauthenticatesthesourceandisthenconfig-uredintoallsecurity-awarenameserversthatwishtovalidateresponsesforthezoneusingatrusted-keysclause.
SecuringthezoneinvolvestheuseofaprivatekeytodigitallysignalltheRRsetsinthezoneusinganRRSIGRRtype.
Onceestablished,securezonescanbelinkedtogetherintochainsoftrustusingtheirdelegationpoints;thusifexample.
comissecured,itmaybelinkedtothe.
comgTLDoritmaybesecurelydelegatedtosub.
example.
com.
ThisprocessisaccomplishedusingtheDelegatedSignerRR,whichisaddedtotheparentdomainandsecuresthedelegationtothechilddomain.
ThepublickeysusedinsigningaredefinedinthezonefileusingDNSKEYRRsandarecategorizedaseitheraZoneSigningKey,whichisusedtosigntherecordswithinthezonefileandaKeySigningKey,whichisusedtosignonlytheDNSKEYRRsusedinthesigningprocessandmaybeusedexternallyaseitheratrustedanchororreferencedbyaDSRR.
WhilethestandardsallowasingleDNSKEYRRtobeusedforbothZSKandKSKpurposes,thisnotarecommendedpractice.
ProofofnonexistenceisprovidedbytheNSECRRs,whichchaintogetheralltheRRswithinthezonefile.
Cryptographickeysneedtobechangedeitherperiodicallytominimizeriskorimmediatelyinthecasewhereakeyisknowntobecompromised.
Thisprocess,calledkeyrollover,mayuseeitheraprepublishordouble-signingstrategy,bothofwhichweredescribed.
Finally,examplesillustratingtheimplementationofDNSSECandcoveringalltheprecedingpointswerepresented.
DNSSECprovidesverypositivebenefitsbutdoesintroducenewlevelsofdiscipline,par-ticularlywithregardtotime—signatures(RRSIGRRs)insecuredzonefilehaveafinitevalidityperiodandthusrequiretobere-signedatperiodicintervals.
Ifthesignaturesareallowedtoexpire,thedatafromthezonewillbemarkedasbogusbyreceivingsecurity-awareservers.
Thenextchapterdescribes,withexampleswhereappropriate,thestatementsandclausesusedinnamed.
conf,theconfigurationfilethatcontrolsBIND'soperationalbehavior.
CHAPTER11sDNSSEC3284940c11_final.
qxd7/8/052:14PMPage328