Last night (Aug. 22 2010 at 00:25:47) SIDN signed the Dutch .nl zone and made it public. This is, of course, reason for a party and calls for the signing of my own zones. Unfortunately it’s not possible to use secure delegation, but that’s something for the future.
I do have two domains up and running and I signed them both.
This is what I did:
First you need a Zone Signing Key (ZSK) and a Key Signing Key (KSK) and these can be made with
dnssec-keygen -e -a RSASHA1 -b 2048 -n ZONE tonkersten.com
dnssec-keygen -a RSASHA1 -b 2048 -n ZONE -f KSK tonkersten.com
This results in two sets of two files (after a very long time)
Ktonkersten.com.+005+42559.key
Ktonkersten.com.+005+42559.private
Ktonkersten.com.+005+61598.key
Ktonkersten.com.+005+61598.private
The key-generating process can be sped up using the -u /dev/urandom
option, but that results in a lower entropy and thus in lower security.
Now include the two public keys in the zone file
$include keys/Ktonkersten.com.+005+42559.key
$include keys/Ktonkersten.com.+005+61598.key
and sign the zone:
dnssec-signzone \
-d keys \
-K keys \
-N increment \
-o tonkersten.com \
-S tonkersten.com
giving me a file called db.tonkersten.fwd.signed.
This file should now be used in /etc/named.conf as the zone file for the
signed zone.
So, when I do a query for the tonkersten.com domain, I get
$ dig +dnssec +multiline DNSKEY home.tonkersten.com
; <<>> DiG 9.7.1-P2 <<>> +dnssec +multiline DNSKEY home.tonkersten.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34594
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;home.tonkersten.com. IN DNSKEY
;; AUTHORITY SECTION:
tonkersten.com. 3600 IN SOA home.tonkersten.com. tonk.tonkersten.com. (
2010082303 ; serial
21600 ; refresh (6 hours)
7200 ; retry (2 hours)
604800 ; expire (1 week)
3600 ; minimum (1 hour)
)
tonkersten.com. 3600 IN RRSIG SOA 5 2 3600 20100922081850 (
20100823081850 61598 tonkersten.com.
W9qamKcSdTfCwOJk+m+tRZsRwdvZVzHzONGCehfX41/I
...
FJ0uZPzfaujQAcKa1NnB89Ccd7m18XL0Gw== )
home.tonkersten.com. 3600 IN NSEC mail.tonkersten.com. A AAAA RRSIG NSEC
home.tonkersten.com. 3600 IN RRSIG NSEC 5 3 3600 20100922081850 (
20100823081850 61598 tonkersten.com.
ZdeRhW5RxqFZguFMOtZhnes/OGA/E2K2CgLLVW3Z00T0
...
PQn52goXz8nXMovgDuB8HNWbzKwSCs07Ug== )
;; Query time: 52 msec
;; SERVER: 80.126.204.63#53(80.126.204.63)
;; WHEN: Mon Aug 23 12:30:43 2010
;; MSG SIZE rcvd: 734
Now it’s your turn.
Good luck ;-)