Configuring DNSSEC On BIND9 (9.7.3) On Debian Squeeze/Ubuntu 11.10 - Page 2

Want to support HowtoForge? Become a subscriber!
 
Submitted by falko (Contact Author) (Forums) on Sun, 2012-04-15 19:35. ::

Now let's sign our example.org zone. We do this with the handy zonesigner tool which is a wrapper around dnssec-keygen and dnssec-signzone. Take a look at

man zonesigner

to learn more about its options. (You can specify default values for zonesigner and rollerd in /etc/dnssec-tools/dnssec-tools.conf so that you don't have to specify so many options on the command line - normally the default values in /etc/dnssec-tools/dnssec-tools.conf should be ok.)

We can sign our zone as follows:

zonesigner -genkeys -usensec3 -zone example.org pri.example.org

We use NSEC3 here to avoid zone walking.

root@server1:/etc/bind# zonesigner -genkeys -usensec3 -zone example.org pri.example.org

        if zonesigner appears hung, strike keys until the program completes
        (see the "Entropy" section in the man page for details)

Generating key pair...++++++ .................................................++++++
Generating key pair..............++++++ .........++++++
Generating key pair............................................
.........................................................................
..........................................+++ ......................
.........................................................................
.................................+++
Verifying the zone using the following algorithms: RSASHA256.
Zone signing complete:
Algorithm: RSASHA256: KSKs: 1 active, 0 stand-by, 0 revoked
                      ZSKs: 1 active, 1 stand-by, 0 revoked

zone signed successfully

example.org:
        KSK (cur) 27916  -b 2048  04/13/12      (example.org-signset-00003)
        ZSK (cur) 31560  -b 1024  04/13/12      (example.org-signset-00001)
        ZSK (pub) 29958  -b 1024  04/13/12      (example.org-signset-00002)

zone will expire in 4 weeks, 3 days, 0 seconds
DO NOT delete the keys until this time has passed.
root@server1:/etc/bind#

As you see, zonesigner has created three key pairs (private/public key pair), a key-signing key (KSK) with the ID 27916 and two zone-signing keys (ZSKs) with the IDs 31560 (active) and 29958 (passive), one active and one passive. We need two ZSKs for key rollovers later on. You can learn more about KSKs and ZSKs on https://dlv.isc.org/about/background; http://www.nlnetlabs.nl/publications/dnssec_howto/#x1-400005 has some good infos about key rollovers and why two ZSKs are needed.

Let's take a look at the /etc/bind directory now:

ls -l

root@server1:/etc/bind# ls -l
total 100
-rw-r--r-- 1 root root  665 Jan 15  2011 bind.keys
-rw-r--r-- 1 root root  237 Jan 15  2011 db.0
-rw-r--r-- 1 root root  271 Jan 15  2011 db.127
-rw-r--r-- 1 root root  237 Jan 15  2011 db.255
-rw-r--r-- 1 root root  353 Jan 15  2011 db.empty
-rw-r--r-- 1 root root  270 Jan 15  2011 db.local
-rw-r--r-- 1 root root 2994 Jan 15  2011 db.root
-rw-r--r-- 1 root bind  167 Apr 13 10:19 dsset-example.org.
-rw-r--r-- 1 root bind 1910 Apr 13 10:19 example.org.krf
-rw-r--r-- 1 root bind  605 Apr 13 10:19 Kexample.org.+008+27916.key
-rw------- 1 root bind 1776 Apr 13 10:19 Kexample.org.+008+27916.private
-rw-r--r-- 1 root bind  431 Apr 13 10:19 Kexample.org.+008+29958.key
-rw------- 1 root bind 1012 Apr 13 10:19 Kexample.org.+008+29958.private
-rw-r--r-- 1 root bind  431 Apr 13 10:19 Kexample.org.+008+31560.key
-rw------- 1 root bind 1012 Apr 13 10:19 Kexample.org.+008+31560.private
-rw-r--r-- 1 root bind  463 Jan 15  2011 named.conf
-rw-r--r-- 1 root bind  490 Jan 15  2011 named.conf.default-zones
-rw-r--r-- 1 root bind  167 Apr 13 10:18 named.conf.local
-rw-r--r-- 1 root bind 1389 Apr 13 10:17 named.conf.options
-rw-r--r-- 1 root bind  723 Apr 13 10:19 pri.example.org
-rw-r--r-- 1 root bind 5912 Apr 13 10:19 pri.example.org.signed
-rw-r----- 1 bind bind   77 Feb  7  2011 rndc.key
drwxr-s--- 2 root bind 4096 Feb  7  2011 slave
-rw-r--r-- 1 root root 1317 Jan 15  2011 zones.rfc1918
root@server1:/etc/bind#

You should see your three key pairs Kexample.org.+008+<ID>.(key|private) where Kexample.org.+008+27916.key is the public KSK and Kexample.org.+008+31560.key the active public ZSK and Kexample.org.+008+29958.key the passive public ZSK.

There's also the file dsset-example.org. which contains the DS records that have to be set up at your registry for your zone:

cat dsset-example.org.

example.org.            IN DS 27916 8 1 20390B300F17E32838B309254E572FCC7CB139B3
example.org.            IN DS 27916 8 2 45A003E0A9FB0EE773F487A7C8FE81A8219EB14741485A925C0D418E 3E45A209

The example.org.krf file contains key management details (like zone name, zone file name, key IDs, expiry, etc.) that are used by zonesigner and rollerd for key management.

cat example.org.krf

zone    "example.org"
        serial          "2012041306"
        kskcur          "example.org-signset-00003"
        zskpub          "example.org-signset-00002"
        zskcur          "example.org-signset-00001"
        zskcount        "1"
        signedzone      "pri.example.org.signed"
        kskcount        "1"
        archivedir      "/var/lib/dnssec-tools/archive"
        kskdirectory    "/etc/bind"
        zskdirectory    "/etc/bind"
        endtime         "+2678400"
        lastset         "example.org-signset-00003"
        zonefile        "pri.example.org"
        keyrec_type     "zone"
        keyrec_signsecs "1334305175"
        keyrec_signdate "Fri Apr 13 08:19:35 2012"
set     "example.org-signset-00001"
        keys            "Kexample.org.+008+31560"
        set_type        "zskcur"
        zonename        "example.org"
        keyrec_setsecs  "1334305173"
        keyrec_setdate  "Fri Apr 13 08:19:33 2012"
set     "example.org-signset-00002"
        keys            "Kexample.org.+008+29958"
        set_type        "zskpub"
        zonename        "example.org"
        keyrec_setsecs  "1334305173"
        keyrec_setdate  "Fri Apr 13 08:19:33 2012"
key     "Kexample.org.+008+31560"
        zonename        "example.org"
        keyrec_type     "zskcur"
        algorithm       "rsasha256"
        random          "/dev/urandom"
        keypath         "/etc/bind/Kexample.org.+008+31560.key"
        zsklength       "1024"
        zsklife         "604800"
        keyrec_gensecs  "1334305173"
        keyrec_gendate  "Fri Apr 13 08:19:33 2012"
key     "Kexample.org.+008+29958"
        zonename        "example.org"
        keyrec_type     "zskpub"
        algorithm       "rsasha256"
        random          "/dev/urandom"
        keypath         "/etc/bind/Kexample.org.+008+29958.key"
        zsklength       "1024"
        zsklife         "604800"
        keyrec_gensecs  "1334305173"
        keyrec_gendate  "Fri Apr 13 08:19:33 2012"
set     "example.org-signset-00003"
        keys            "Kexample.org.+008+27916"
        set_type        "kskcur"
        zonename        "example.org"
        keyrec_setsecs  "1334305173"
        keyrec_setdate  "Fri Apr 13 08:19:33 2012"
key     "Kexample.org.+008+27916"
        zonename        "example.org"
        keyrec_type     "kskcur"
        algorithm       "rsasha256"
        random          "/dev/urandom"
        keypath         "/etc/bind/Kexample.org.+008+27916.key"
        ksklength       "2048"
        ksklife         "15552000"
        revperiod       "3888000"
        keyrec_gensecs  "1334305174"
        keyrec_gendate  "Fri Apr 13 08:19:34 2012"

The most important thing is, there's now a new zone file, pri.example.org.signed - it's the signed version of pri.example.org. This is how it looks:

cat pri.example.org.signed

; File written on Fri Apr 13 10:19:34 2012
; dnssec_signzone version 9.7.2-P3
example.org.            3600    IN SOA  server1.example.com. zonemaster.example.com. (
                                        2012041306 ; serial
                                        7200       ; refresh (2 hours)
                                        540        ; retry (9 minutes)
                                        604800     ; expire (1 week)
                                        86400      ; minimum (1 day)
                                        )
                        3600    RRSIG   SOA 8 2 3600 20120514071934 (
                                        20120413071934 31560 example.org.
                                        PBITMuBEZzMHSw53keFzfAxWzhj/iqgUZsA+
                                        XSD5eahnXSla+J6nSzeU0j0Zw+6z4TBkQeBm
                                        OzKMNjO6Zq1vK18nQH8Gg7uJgROjYU7XtPAw
                                        laCsFWcOhna9RCUayZf8Ft3Emu7BG1Bp16rz
                                        SdQhte0UPk/1k0nO1d6JpyXmCUY= )
                        86400   NS      server1.example.com.
                        86400   NS      server2.example.com.
                        86400   RRSIG   NS 8 2 86400 20120514071934 (
                                        20120413071934 31560 example.org.
                                        OYzDYsxaKvzEmI+DCtgbjycy1I1l+O+42Uwy
                                        R/YAKzEEwRTswIbj/cjbmBb7HmWJVHkqLHw/
                                        xWPt9MwjSPyJZyGQtVgrHhmxZSf1vNByqHFU
                                        evUhg1qsRBwFQfoayDKQWC77MkCn6qzYa5W4
                                        VxChDYP2rCkgaCuYnWLPm3o82RY= )
                        3600    A       1.2.3.4
                        3600    RRSIG   A 8 2 3600 20120514071934 (
                                        20120413071934 31560 example.org.
                                        oGCbVz6tro67wrwDKeG5UOugTjGxXaC1BODd
                                        LZtNHo4NAk9iuTQIOdWbITsNotXqx8qpwhVp
                                        xSXEqcjqdyAKH3530A/lxntEDJzAfzLP7sFI
                                        QfpYn2WedeFox6J9U1uNmkg45ddIsWE67AGC
                                        8emmsxj2+WieGJ4BpiIvaZguOuI= )
                        3600    MX      10 mail.example.org.
                        3600    RRSIG   MX 8 2 3600 20120514071934 (
                                        20120413071934 31560 example.org.
                                        DUAKpO9aRDfHKSxeqIkNT6NwmZNY22U3i9M2
                                        0y13FQ+fexUp+VAeAuOr2Yzl/jipTKFYkFbL
                                        vh5pcOGb3nW/uPnFsGWUKX8g9E8sW22uPPO4
                                        Xa7riEXylHAPqL7BU+/6AxAZqsAS4/ZE2MUL
                                        qY/kq5ZiY1+GptMnINjh7THNfDs= )
                        3600    TXT     "v=spf1 a mx ptr -all"
                        3600    RRSIG   TXT 8 2 3600 20120514071934 (
                                        20120413071934 31560 example.org.
                                        cWzBNj/79/HRXyHFY2Qrtwygw8lviiSS90Na
                                        qEbFIbpnMIjkjQHW1xL8CjJTg3xawWrdCi1T
                                        dyAZu4PGLZiEfRRjyWzKyvjjdOaaUBlaPkVY
                                        VWGuYAUX4e6IqRe7CRNDIdELMPxRk+AqVn36
                                        T6HPOaOnd5tXM1APW2f8OOI4hmA= )
                        3600    DNSKEY  256 3 8 (
                                        AwEAAbiLwZNsdmDJDqpRppqAxMkKMZF6F4wi
                                        /QulmN1LUi2uA9zzz8O6V+NAhYDh8GBP3dNm
                                        Zl+2DAJRm9ckL1PLc7ndTbvZYU4fIHYaCwJ+
                                        5pDztrWA4mz960RQKCVaV6g25Gr1dWF2vQtt
                                        QlXGTlnWijbPkjtBxVuTgN2HUzC1+RLj
                                        ) ; key id = 31560
                        3600    DNSKEY  256 3 8 (
                                        AwEAAcoCzDx4onsEaFuMYN7GbID8jcM7Ct5F
                                        dBKcU8FCx7wIDpsfDi0OTDsoZk9TaWBdCOh4
                                        KbL7TbI7aue30irpCb/XLTG3B1JQEWRSWoGS
                                        ZxnAA3FzI9QvpJJhNBrr1nwbNq8QDmZnA7dF
                                        00LxLtQy/G7cJew4yNxb/hM1imhHk8bx
                                        ) ; key id = 29958
                        3600    DNSKEY  257 3 8 (
                                        AwEAAbjthg82WErIMm+gcsOeNlI6j7/9Vuih
                                        QtYVnt9dOFWeddfZxlbvVIFKklxBLMmBt4Z5
                                        GULTDKg+2BA6hGq3UGTHJMg1cpYTZtUBF4R1
                                        LnxL2KB15rBFtU8b3C8OtrpGsEI/VUWeii5I
                                        PopFU04QMDCQkXBiulwHbG6ZcynlvYeaUC94
                                        CVabjTPpO95BysAZqBrxQsWyokMWwMtX6V0+
                                        uYlzGIU2OJazpYkWsIrAfpY2dRL15pugx4gC
                                        WMZwdsrfiHZSS7nlDCaDbAgsTS5tQiU4zy2Y
                                        Q7vst7U4Zmh0+WbfHefeyVByCdiQaF2UmVsm
                                        nTxuEtu1Y3SSClmDzq2/wW8=
                                        ) ; key id = 27916
                        3600    RRSIG   DNSKEY 8 2 3600 20120514071934 (
                                        20120413071934 27916 example.org.
                                        hi4iklMgcGJPeBa+vOHfXdKzC0/UcizxPO7x
                                        QCWohh9/5TMABgWyhtjjxPFeMpayqTLdS2QP
                                        LARIIMrCNERHweZ9ucq3iwUXUCywzX/opxuu
                                        UpHKiPy0+efWIOEa+oje20bnDHOApqf/iwjs
                                        5N5GKY5KYdDb7ESy/TVthc7hiWJHcEwjkp9u
                                        w98CQ6AubygmuHweR0ZGhtDRSBjssllgf7+w
                                        v7vIPfcR0M/iQVdWlZif5kfSeJwc0XwycyPr
                                        vRljcNW5rXxi76663WrFg3CgtuwF5KpNzK6+
                                        u4ai8J5nmIy9HCFDhVb2heyLqIdGXfr4A3PY
                                        whwQbSISeLukYzPcJg== )
                        3600    RRSIG   DNSKEY 8 2 3600 20120514071934 (
                                        20120413071934 31560 example.org.
                                        kvzkVv3+mf+hTQOaDnV0Da6wQp7f8j7STRnP
                                        QfbOX7L4BSgCZAC1nX3gvwUJ4++bn0qZufZk
                                        buqL+x2FP/DynKpgZBXXu72zRx9yrScHZXHT
                                        HxicYCEoFfuz0SS+OAeVFs96NpTCg1Qe7xQl
                                        +dg0nnmmq3BBSkggxble2Drz9hQ= )
                        0       NSEC3PARAM 1 0 100 BAC4DE566D0E4403
                        0       RRSIG   NSEC3PARAM 8 2 0 20120514071934 (
                                        20120413071934 31560 example.org.
                                        JgpKxiJmynRC6sI2dqSweHSCk6LYdARhP67M
                                        7N/tlBKn3LmwWUAzxFy+TUxlmz1TKYJra9AT
                                        zskc/QP0fdKubFZPgXY0AGAKWLjBUftE71jY
                                        R5+uYgUOHCrlFaSK4i7iPbeEkHRYkj2MVWkj
                                        oPQlDCZEFe0b6XtOB+c3VAkmibk= )
www.example.org.        3600    IN A    1.2.3.4
                        3600    RRSIG   A 8 3 3600 20120514071934 (
                                        20120413071934 31560 example.org.
                                        lm64+7cGoS1DmHqm73aIAB3HGh74Asih9HB/
                                        D6YUpONoVKax78aDnHCrypbTs33GKgUp2sW/
                                        ZI1AVrDAclCIO8zs6Cr3Efl6OjU2NlaMnNKk
                                        xFZk+UgD7Qna/0qfcBdpZzdfXcez3m+/ItOE
                                        mSAknyO2K+h7jqNZBsJAgUgVtmo= )
06C7U6DINN1SA2C7HK9GFBTSOU0KADR8.example.org. 86400 IN NSEC3 1 0 100 BAC4DE566D0E4403 HBSF972BMNBCF9J9LCP9453EAM3A5J96 A NS SOA MX TXT RRSIG DNSKEY NSEC3PARAM
                        86400   RRSIG   NSEC3 8 3 86400 20120514071934 (
                                        20120413071934 31560 example.org.
                                        Sj0BJA2jWC+Lcifn6F2Iavelv81hdW/UxnN9
                                        8MYikEjCAw80NJBRq7N6YMEkw0Qoh0zT06Qe
                                        zGysgca8b6+njkc3YGl5NhtwV0cnL0EC9xUj
                                        MdyoaRbgKlNIiWzwABd0YbFBSThVtBgeAqan
                                        TqZXwRMQR+BZ4IVIpEWZ891ijYI= )
HBSF972BMNBCF9J9LCP9453EAM3A5J96.example.org. 86400 IN NSEC3 1 0 100 BAC4DE566D0E4403 TNBUBU0J4E7QEMO9NNCGMJ7BK5A03GLN A RRSIG
                        86400   RRSIG   NSEC3 8 3 86400 20120514071934 (
                                        20120413071934 31560 example.org.
                                        WhobKFIWJd5g3TNckzp9ilORttoBLpXa/Ng3
                                        8RI1Hb367i7+S8gZDQD81Jm6RA0PYxDR7MgA
                                        UShRIb3UK8EjSFj+B+Dnbrs/UiwYQ/PjOYRM
                                        TzXuK8uYJ1Q8UTMdyDC9uFQ7Ju8+G0vQQBMC
                                        lkTo9MWR4a8bDsDqRytg+0WeBCs= )
TNBUBU0J4E7QEMO9NNCGMJ7BK5A03GLN.example.org. 86400 IN NSEC3 1 0 100 BAC4DE566D0E4403 06C7U6DINN1SA2C7HK9GFBTSOU0KADR8 A RRSIG
                        86400   RRSIG   NSEC3 8 3 86400 20120514071934 (
                                        20120413071934 31560 example.org.
                                        SueRnWwggy3PCVk3Z3emXVMoMIDwVi8XhDf/
                                        o0gpmnqm/1ZKXsHRKI3KvfUa3EUAqGH27ZyP
                                        GNsSbmgabAwpw8bXbc2y5hQLK9BVFTczolgh
                                        5tws4Ok/rhec5CmoPzACt/lKkP4s9b8VmltY
                                        bh7FPA9mYarlNF4OGRNDCCp97r8= )
mail.example.org.       3600    IN A    1.2.3.4
                        3600    RRSIG   A 8 3 3600 20120514071934 (
                                        20120413071934 31560 example.org.
                                        totQYEtfcNAjyUuvgaJcXeY0Bc5a5DYnmFDG
                                        1u+7wyUrpMkSGRNlcZAuqrdy8ZNx1roacrAa
                                        iaHVz3ZsuTdYS7jyLmEZe1WdQZy7DN4POoBe
                                        YWH4AXu8ixH2PIheOC+7b6v/T+1FTi92NeXY
                                        FSNSqyvKSV6zzROM/qEcUwh1Sr8=

You see, it's much larger than the intial zone file.

We can use donuts to check if there are any problems with the signed zone file:

donuts --level 8 -v pri.example.org.signed example.org

If everything is ok, you shouldn't see any warnings or errors:

root@server1:/etc/bind# donuts --level 8 -v pri.example.org.signed example.org
--- loading rule file /usr/share/dnssec-tools/donuts/rules/check_nameservers.txt
    rules: MEMORIZE_NS_ADDRS DNS_SERVERS_MATCH_DATA
--- loading rule file /usr/share/dnssec-tools/donuts/rules/dns.errors.txt
    rules: DNS_SOA_REQUIRED MEMORIZE_NS_CNAME_RECORDS DNS_NS_NO_CNAME
--- loading rule file /usr/share/dnssec-tools/donuts/rules/dnssec.rules.txt
    rules: DNSSEC_RRSIG_TTL_MATCH_ORGTTL DNSSEC_MEMORIZE_NS_RECORDS DNSSEC_CHECK_IF_NSEC3
 DNSSEC_MISSING_NSEC_RECORD DNSSEC_MISSING_RRSIG_RECORD DNSSEC_RRSIG_NOT_SIGNING_RRSIG DNSSEC_RRSIG_FOR_NS_GLUE_RECORD
 DNSSEC_NSEC_FOR_NS_GLUE_RECORD DNSSEC_RRSIG_SIGEXP DNSSEC_NSEC_TTL DNSSEC_NSEC3_TTL DNSSEC_DNSKEY_MUST_HAVE_SAME_NAME
 DNSSEC_DNSKEY_PROTOCOL_MUST_BE_3 DNSSEC_BOGUS_NS_MEMORIZE DNSSEC_MISSING_RRSIG_RECORD DNSSEC_RRSIG_TTL_MUST_MATCH_RECORD
 DNSSEC_MISSING_NSEC_RECORD DNSSEC_RRSIG_SIGNER_NAME_MATCHES DNSSEC_NSEC_RRSEC_MUST_NOT_BE_ALONE DNSSEC_MEMORIZE_KEYS
 DNSSEC_RRSIGS_VERIFY DNSSEC_TWO_ZSKS DNSSEC_OPENSSL_KEY_ISSUES
--- loading rule file /usr/share/dnssec-tools/donuts/rules/nsec_check.rules.txt
    rules: DNSSEC_NSEC_MEMORIZE DNSSEC_NSEC3_MEMORIZE DNSSEC_NSEC3_CHECK DNSSEC_NSEC_CHECK
--- loading rule file /usr/share/dnssec-tools/donuts/rules/parent_child.rules.txt
    rules: DNS_MULTIPLE_NS DNSSEC_SUB_NOT_SECURE DNSSEC_DNSKEY_PARENT_HAS_VALID_DS DNSSEC_DS_CHILD_HAS_MATCHING_DNSKEY
--- loading rule file /usr/share/dnssec-tools/donuts/rules/recommendations.rules.txt
    rules: DNS_REASONABLE_TTLS DNS_NO_DOMAIN_MX_RECORDS
--- Analyzing individual records in pri.example.org.signed
--- Analyzing records for each name in pri.example.org.signed
results on testing example.org:
  rules considered:     38
  rules tested:         30
  records analyzed:     28
  names analyzed:       6
  errors found:         0
root@server1:/etc/bind#

Let's check the contents of our KSK (we will need this later on to create a trust anchor on our resolver server3 to do some testing before we submit the DS records to the registry):

cat Kexample.org.+008+27916.key

; This is a key-signing key, keyid 27916, for example.org.
; Created: 20120413081933 (Fri Apr 13 10:19:33 2012)
; Publish: 20120413081933 (Fri Apr 13 10:19:33 2012)
; Activate: 20120413081933 (Fri Apr 13 10:19:33 2012)
example.org. IN DNSKEY 257 3 8 AwEAAbjthg82WErIMm+gcsOeNlI6j7/9VuihQtYVnt9dOFWeddfZxlbv VIFKklxBLMmBt4Z5GULTDKg+2BA6hGq3UGTHJMg1cpYTZtUBF4R1LnxL 2KB15rBFtU8b3C8OtrpGsEI/VUWeii5IPopFU04QMDCQkXBiulwHbG6Z cynlvYeaUC94CVabjTPpO95BysAZqBrxQsWyokMWwMtX6V0+uYlzGIU2 OJazpYkWsIrAfpY2dRL15pugx4gCWMZwdsrfiHZSS7nlDCaDbAgsTS5t QiU4zy2YQ7vst7U4Zmh0+WbfHefeyVByCdiQaF2UmVsmnTxuEtu1Y3SS ClmDzq2/wW8=

Now we must update named.conf.local...

vi named.conf.local

... and replace pri.example.org with pri.example.org.signed:

zone "example.org" {
        type master;
        allow-transfer {192.168.0.101;};
        also-notify {192.168.0.101;};
        file "/etc/bind/pri.example.org.signed";
};

Restart BIND afterwards:

/etc/init.d/bind9 restart


Please do not use the comment function to ask for help! If you need help, please use our forum.
Comments will be published after administrator approval.