Groesbeek, view of the 'National Liberation Museum 1944-1945' in Groesbeek. © Ton Kersten
Fork me on GitHub

DNSSEC for tonkersten.com and pa1ton.nl

2010-08-23 (65) by Ton Kersten, tagged as dnssec

Last night (Aug. 22 2010 at 00:25:47) SIDN signed the Dutch .nl zone and made it public. This is, of course, reason for a party and calls for the signing of my own zones. Unfortunately it's not possible to use secure delegation, but that's something for the future.

I do have two domains up and running and I signed them both.

This is what I did:

First you need a Zone Signing Key (ZSK) and a Key Signing Key (KSK) and these can be made with

dnssec-keygen -e -a RSASHA1 -b 2048 -n ZONE        tonkersten.com
dnssec-keygen    -a RSASHA1 -b 2048 -n ZONE -f KSK tonkersten.com

This results in two sets of two files (after a very long time)

Ktonkersten.com.+005+42559.key
Ktonkersten.com.+005+42559.private
Ktonkersten.com.+005+61598.key
Ktonkersten.com.+005+61598.private

The key-generating process can be sped up using the -u /dev/urandom option, but that results in a lower entropy and thus in lower security.

Now include the two public keys in the zone file

$include keys/Ktonkersten.com.+005+42559.key
$include keys/Ktonkersten.com.+005+61598.key

and sign the zone:

dnssec-signzone          \
    -d keys              \
    -K keys              \
    -N increment         \
    -o tonkersten.com    \
    -S tonkersten.com

giving me a file called db.tonkersten.fwd.signed.

This file should now be used in /etc/named.conf as the zone file for the signed zone.

So, when I do a query for the tonkersten.com domain, I get

$ dig +dnssec +multiline DNSKEY home.tonkersten.com

; <<>> DiG 9.7.1-P2 <<>> +dnssec +multiline DNSKEY home.tonkersten.com
;; global options:  +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34594
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;home.tonkersten.com.   IN DNSKEY

;; AUTHORITY SECTION:
tonkersten.com.     3600 IN SOA home.tonkersten.com. tonk.tonkersten.com. (
2010082303 ; serial
21600      ; refresh (6 hours)
7200       ; retry (2 hours)
604800     ; expire (1 week)
3600       ; minimum (1 hour)
)
tonkersten.com.     3600 IN RRSIG SOA 5 2 3600 20100922081850 (
20100823081850 61598 tonkersten.com.
W9qamKcSdTfCwOJk+m+tRZsRwdvZVzHzONGCehfX41/I
...
FJ0uZPzfaujQAcKa1NnB89Ccd7m18XL0Gw== )
home.tonkersten.com.    3600 IN NSEC mail.tonkersten.com. A AAAA RRSIG NSEC
home.tonkersten.com.    3600 IN RRSIG NSEC 5 3 3600 20100922081850 (
20100823081850 61598 tonkersten.com.
ZdeRhW5RxqFZguFMOtZhnes/OGA/E2K2CgLLVW3Z00T0
...
PQn52goXz8nXMovgDuB8HNWbzKwSCs07Ug== )

;; Query time: 52 msec
;; SERVER: 80.126.204.63#53(80.126.204.63)
;; WHEN: Mon Aug 23 12:30:43 2010
;; MSG SIZE  rcvd: 734

Now it's your turn.

Good luck smiley

Comments