linux:skoleni:dns [Starlab knowledge base]

[Show page]
[Old revisions]
[[unknown link type]]
[
]
This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
Nejdulezitejsi utilita ''dig' se nachazi v debianu v netradicne pojmenovanem baliku bez pomlcky
   apt-get install dnsutils
   
Rozdilne odpovedi na spatne podepsanou (zfalsovanou) domenu www.rhybar.cz
  dig +dnssec +multi www.rhybar.cz
  dig +cd +dnssec +multi www.rhybar.cz
  
Rozdilne odpovedi DNS serveru
<code>
dig +dnssec +multi www.dnssec.cz @212.20.96.34
dig +dnssec +multi www.dnssec.cz @8.8.8.8
</code>
Analyza paketu
  tcpdump -n host 212.20.96.34 -X
  
  
====== Pridani nove domeny do bindu ======
Definice zony. Bind je velmi citlivy na uvozovky, stredniky a jina zviratka
<file /etc/bind/named.conf.local>
zone "dalibor.cz" {
	type "master";
	file "dalibor.cz";
};
</file>

Zonovy soubor
<code>
$ORIGIN .
$TTL 8h
dalibor.cz. IN SOA ns.dalibor.cz. hostmaster.dalibor.cz (
                201401; serial
                8h; refresh
                4h; retry
                2d; expire
                8h; minimum
)
$ORIGIN dalibor.cz.
        IN      A       1.2.3.4
ns      IN      A       10.0.4.151
zeus    IN      A       10.0.4.151
        IN      A       10.0.4.190
        IN      A       10.0.4.196
mail    IN      A       10.0.4.151
www     IN      A       10.0.4.151
</code>

<code>
//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

zone "dalibor.cz" {
        type master;
        allow-transfer { 10.0.4.190; };
        file "dalibor.cz";
};

zone "kotrlik.cz" {
        type slave;
        masters { 10.0.4.187; };
        file "xxx";
};
</code>

Bind cache
   rndc dumpdb -cache
===== BIND9 =====
   * filipika proti prilisnemu vztahu bind9 a rfc
   * otazka kdo ma delat replikaci zon?
===== powerdns =====
  apt-get install pdns-server mysql-server
  * http://downloads.sourceforge.net/project/poweradmin/poweradmin-2.1.7.tgz?r=http%3A%2F%2Fwww.poweradmin.org%2F&ts=1409754165&use_mirror=optimate

   apt-get install apache2 php5


====== Zneuziti zony pescomnet.cz ======
Todle me bude stat vice nez jednoho panaka...

<code>
dnssec-keygen -a RSASHA1 -b1024 -r /dev/urandom -f KSK pescomnet.cz
Kpescomnet.cz.+005+10531

dnssec-keygen -a RSASHA1 -b512 -r /dev/urandom  pescomnet.cz
Kpescomnet.cz.+005+63687
</code>

<file ls.txt>
-rw-r--r--  1 root bind  212 2014-09-02 22:24 Kpescomnet.cz.+005+10531.key
-rw-------  1 root bind  937 2014-09-02 22:24 Kpescomnet.cz.+005+10531.private
-rw-r--r--  1 root bind  126 2014-09-02 22:26 Kpescomnet.cz.+005+63687.key
-rw-------  1 root bind  549 2014-09-02 22:26 Kpescomnet.cz.+005+63687.private
</file>

Klice pridame do bezneho zonoveho souboru 
   cat Kpescom*key >> pescomnet.cz

A podepiseme:
<code>
dnssec-signzone pescomnet.cz
Verifying the zone using the following algorithms: RSASHA1.
Zone signing complete:
Algorithm: RSASHA1: ZSKs: 1, KSKs: 1 active, 0 revoked, 0 stand-by
pescomnet.cz.signed
</code>


====== Dulezita poznamka ======
Zóna .CZ vyžaduje KSK klíč

Po tomto nastavení vezmeme DNSKEY z podepsané zóny a pošleme jej přes svého registrátora do .CZ zóny:

**pozn.** nasledujici prikaz nemusi fungovat, pokud jste klice do domeny nepridali
  grep -E "DNSKEY[[:white:]]257" pescomnet.cz
  
Takze pouzivam zase dig
 <code>    
     dig DNSKEY starlab.cz @localhost
     starlab.cz.             28800   IN      DNSKEY  257 3 5 AwEAAdSYwjNYONb00hXA4EBuTnjro5pNeZe5gHZSzBbR0OnRu7NEjehy zgQ81FkM9SwATwfWrKPEaRK3tx/WDm7wZkFKLH3KNgnD0OvxFbbO/9/u EBv8DVApNrq6zJhdrlQnSik3BRuR8Q470kCZ1a7Dodoo7YzVVv/Zv6vP zZwVqGa+qS63smPvm4q4XMuWm8QECodhKUJXzzoGPk+D9ZqTSQwziTEs 8r4wNEhgLNFiYeQBtZGjL6QdRJZy4Dc6d5faWAlveQnZmDJBilf52K43 kvUeOZz7kBZndv+OgRE35bRe3LKrJ1vi56D65lYDGDzNt8aZt/qKM54H SJSMfTHY24M=
</code>
 

Jak tento klíč poslat do registru je zapotřebí dohodnout s vlastním registrátorem.
linux/skoleni/dns.txt · Last modified: 2014/09/03 16:25 by admin