DNSSEC, BIND9, ...

["Michael Paoli" <Michael.Paoli@cal.berkeley.edu>]

So, some questions were asked earlier today regarding DNSSEC and
BIND9.

I'd mentioned I had some information on that and/or had earlier sent
out some notes on such.

I also mentioned I take care of some domains that have DNSSEC set up,
these include:
balug.org
sf-lug.org
sf-lug.com
(plus a couple of my own ... so ... 5 total).

Once DNSSEC is in place, maintaining it is quite easy.  Just need to be
reasonably careful when setting it up.  I think about the last thing
I did with DNSSEC that was a slightly more involved change, was
changing out some key(s) - I believe KSKs, ... as they were
(inefficiently) "too big" - notably stronger and longer than up-stream,
so no real security advantage, and mostly disadvantage in CPU burn
(extra cycle(s) for verification) and size (more bits to shuffle about
across the network).

And peeking a bit again, I've got this in my
notes:

DNSSEC with BIND >=9.9 and inline-signing

guide:
  https://ftp.isc.org/isc/dnssec-guide/dnssec-guide.pdf

key directory, e.g.:
named.conf:include "/etc/bind/named.conf.options";
named.conf.options:     key-directory "/var/cache/bind/keys";
# cd /var/cache/bind/keys && pwd -P && ls -ld .
/var/lib/named/var/cache/bind/keys
drwxrwx--- 2 root bind 4096 Sep 23 05:55 .
#

generate keys
# (umask 037 && dnssec-keygen -a RSASHA256 -b 1024 balug.org &&  
dnssec-keygen -a RSASHA256 -b 2048 -f KSK balug.org)
SAVE COPIES!!! (if DS is set up in parent and private keys lost, one  
is screwed)

At least as of 2017-09-24:
Algorithm:
.(root),com,net is using 8 (RSASHA256)
org is using 7 (NSEC3RSASHA1)
bits:
.(root) is using 2048
com,net,org is using 2048 (KSK) / 1024 (ZSK)

enable inline signing for zone:
inline-signing yes;
auto-dnssec maintain;
serial-update-method unixtime;
(or default of: serial-update-method increment;)

resources:
guide: https://ftp.isc.org/isc/dnssec-guide/dnssec-guide.pdf
excellent troubleshooting: http://dnsviz.net/
Debian wiki bits (rather out-of-date at last check):
  https://wiki.debian.org/DNSSEC
  https://wiki.debian.org/DNSSEC%20Howto%20for%20BIND%209.9+
BIND documentation
more lists of resources: https://www.isc.org/downloads/bind/dnssec/
resolver validation checks:
  http://dnssec.vs.uni-due.de/
  https://rootcanary.org/test.html
  https://en.internet.nl/connection/

--
You received this message because you are subscribed to the Google Groups "BerkeleyLUG" group.
To unsubscribe from this group and stop receiving emails from it, send an email to berkeleylug+unsubscribe@googlegroups.com.
To post to this group, send email to berkeleylug@googlegroups.com.
Visit this group at https://groups.google.com/group/berkeleylug.
For more options, visit https://groups.google.com/d/optout.