DNSSEC 启用和后备

DNSSEC 启用和后备

我遇到了一个绑定设置,其中只有一个 DNSSEC 值设置如下:

dnssec-validation yes;  

并且named.conf.options中的键声明如下:

include "/etc/bind.keys"

然而,其余部分:

dnssec-enable yes;
dnssec-lookaside auto;

根本没有在任何地方设置。

现在的问题是这个设置到底能不能用?我没有看到任何错误。如果能提供任何评论/建议/意见,我将不胜感激。提前致谢!

答案1

阅读评论后,让我使用 bind 展示两种情况(dnssec针对您的域和dnssec客户端)的设置views

考虑以下配置(我在生产中使用)

options {
        listen-on port 53 { any; };
        max-cache-size 128M;
        interface-interval 0;
        notify explicit;
        allow-transfer { none; };
        allow-update { none; };
        allow-recursion { none; };
        forwarders {
            2620:119:35::35;
            2620:119:53::53;
            208.67.222.222;
            208.67.220.220;
            2001:4860:4860::8888;
            2001:4860:4860::8844;
            8.8.8.8;
            8.8.4.4;
        };
        //dig -t txt -c chaos VERSION.BIND @<dns.server.com>
        version "Microsoft Windobe 2008 DNS Server. Et je t'emmerde (-_-)";
        auth-nxdomain no;    # love RFC1035
        dnssec-enable yes;
        dnssec-validation auto;
};

acl internal {
    127.0.0.0/8;
    ::1/128;
    10.0.0.0/8;
    fd9f::/64;
};

acl external {
    any;
};

view "internal" {
    match-clients {
        internal;
    };
    allow-recursion {
        any;
    };
};

view "external" {
    match-clients {
        any;
    };
    recursion no;
    zone "127-0-0-1.fr" {
        type master;
        file "/var/lib/bind/127-0-0-1.fr.db";
        key-directory "/var/lib/bind";
        auto-dnssec maintain;
        inline-signing yes;
    };
};

该 BIND9 服务器充当域的权威名称服务器127-0-0-1.fr,并充当内部(私人)客户端的递归名称服务器。

让我们尝试以内部客户端的身份解析启用 DNSSEC(完整链正常)的域dig @fd9f::10:0:0:2 www.isc.org

; <<>> DiG 9.14.4 <<>> @fd9f::10:0:0:2 isc.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49658
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: d1c6f836121beafdedbc5fae5d5e281dc5c58851413f4fb2 (good)
;; QUESTION SECTION:
;isc.org.                       IN      A

;; ANSWER SECTION:
isc.org.                59      IN      A       149.20.1.66

;; Query time: 136 msec
;; SERVER: fd9f::10:0:0:2#53(fd9f::10:0:0:2)
;; WHEN: Thu Aug 22 07:29:01 CEST 2019
;; MSG SIZE  rcvd: 80

注意ad标志意味着经过验证的数据. 请查看delv @fd9f::10:0:0:2 www.isc.org

;; fetch: isc.org/A
;; fetch: isc.org/DNSKEY
;; fetch: isc.org/DS
;; fetch: org/DNSKEY
;; fetch: org/DS
;; fetch: ./DNSKEY
; fully validated
isc.org.                59 IN A 149.20.1.66
isc.org.                59 IN RRSIG A 5 2 60 (
                                20190904145623 20190805140610 28347 isc.org.
                                ty+0um1WeOQvOIDMfA0w4spR4qNwm4Pj581KA9xXMFro
                                0+N0bKDAcDJ3O8EpdEHzjejXU0GqrJvIyml7fpvmbcN4
                                b2QWr/INjW8e+MzFz49oajGF0G1Oi6Qzp/XIljibsSig
                                FUTZsnp5yL77PF2eJEc4CDlfgJOCGsYnWTEaNuI= )
isc.org.                59 IN RRSIG A 13 2 60 (
                                20190904145623 20190805140610 27566 isc.org.
                                QiL6Al0ycqO/Fxl4OUR017ck/Y6xnRG4qt/pRvzG1H/y
                                +xyt9EU3pvNqbus5mQYF7ruH6BFyQg5w94bnnjivGg== )

现在同样的检查 DNSSESC已启用的域dig @fd9f::10:0:0:2 dnssec-failed.org

; <<>> DiG 9.14.4 <<>> @fd9f::10:0:0:2 dnssec-failed.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 21410
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 758deba64c4f30ba6ac402da5d5e28d3572fa9aa192352cd (good)
;; QUESTION SECTION:
;dnssec-failed.org.             IN      A

;; Query time: 4298 msec
;; SERVER: fd9f::10:0:0:2#53(fd9f::10:0:0:2)
;; WHEN: Thu Aug 22 07:32:03 CEST 2019
;; MSG SIZE  rcvd: 74

如您所见,解析失败,SERVFAIL并且绑定日志显示

bind             | 22-Aug-2019 04:17:09.845 client @0x55b0a804ea80 fd9f::1#49348 (www.dnssec-failed.org): view internal: query: www.dnssec-failed.org IN A +E(0)K (fd9f::10:0:0:2)
bind             | 22-Aug-2019 04:17:09.938 view internal: validating www.dnssec-failed.org/A: bad cache hit (dnssec-failed.org/DNSKEY)
bind             | 22-Aug-2019 04:17:09.938 broken trust chain resolving 'www.dnssec-failed.org/A/IN': 2001:4860:4860::8888#53
bind             | 22-Aug-2019 04:17:09.938 client @0x55b0a804ea80 fd9f::1#49348 (www.dnssec-failed.org): view internal: query failed (broken trust chain) for www.dnssec-failed.org/IN/A at query.c:6786

但是如果我强制解决,dig @fd9f::10:0:0:2 dnssec-failed.org +cd我能够得到响应,但没有do标志,响应就不会被签名。

127-0-0-1.fr现在让我们从外部对我的域进行一些检查delv @2001:4860:4860::8888 www.127-0-0-1.fr +rtrace +multiline

;; fetch: www.127-0-0-1.fr/A
;; fetch: 127-0-0-1.fr/DNSKEY
;; fetch: 127-0-0-1.fr/DS
;; fetch: fr/DNSKEY
;; fetch: fr/DS
;; fetch: ./DNSKEY
; fully validated
www.127-0-0-1.fr.       3599 IN A 164.132.222.187
www.127-0-0-1.fr.       3599 IN RRSIG A 7 2 3600 (
                                20190914021052 20190815015938 64469 127-0-0-1.fr.
                                aaQN/x+ZEfV1Vgp78QGdCEByau22cmt61pQ+7c+VdiUh
                                gmOy0+sPHcJZT6aq6FKRLMc+I76R/ZrzAnCK7mr96vXb
                                SCyiIVYGMva9lsl95zi4DK5FxacekonBkwB/l/upBhxb
                                Iiw+l3AZ4J19I7nQgGCSxj7vWqtQD1sb8jue/fw= )

最后检查一下dig @2001:4860:4860::8888 www.127-0-0-1.fr

; <<>> DiG 9.14.4 <<>> @2001:4860:4860::8888 www.127-0-0-1.fr
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45032
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.127-0-0-1.fr.              IN      A

;; ANSWER SECTION:
www.127-0-0-1.fr.       3536    IN      A       164.132.222.187

;; AUTHORITY SECTION:
127-0-0-1.fr.           3536    IN      NS      brown-sugar.127-0-0-1.fr.
127-0-0-1.fr.           3536    IN      NS      black-pearl.127-0-0-1.fr.

;; Query time: 10 msec
;; SERVER: 2001:4860:4860::8888#53(2001:4860:4860::8888)
;; WHEN: Thu Aug 22 06:23:52 CEST 2019
;; MSG SIZE  rcvd: 113

展示ad旗帜意味着经过验证的数据。您可以使用基于 Web 的工具进行检查,例如dnssec 分析器

相关内容