DNSSEC
https://www.iana.org/domains/root/servers
whois islief.com dig +short NS islief.com dig +short SOA islief.com
dig +short DS islief.com dig +short DNSKEY islief.com
dig +short A islief.com dig +short AAAA islief.com
dig +short MX islief.com
dig +trace +all www.islief.com dig com @f.root-servers.net dig islief.com @g.gtld-servers.net
dnssec-settime -I +172800 -D +345600 Kjanmg.com.+005+12332.key dnssec-keygen -a NSEC3RSASHA1 -b 2048 -n ZONE janmg.com dig A janmg.com. @localhost +noadditional +dnssec +multiline
https://manager.linode.com/dns/domain%5Fslave/janmg%2Ecom
cd /var/bind/ dnssec-keygen -a NSEC3RSASHA1 -b 4096 -n ZONE janmg.com dnssec-settime -I +172800 -D +345600 Kjanmg.com.+005+12332.key dig A janmg.com. @localhost +noadditional +dnssec +multiline dnssec-keygen -f KSK -a NSEC3RSASHA1 -b 4096 -n ZONE janmg.com sudo vi /etc/bind/zone/janmg.com sudo service named restart dnssec-signzone -A -3 $(head -c 1000 /dev/urandom | sha256sum | cut -b 1-16) -N INCREMENT -o janmg.com -t /etc/bind/zone/janmg.com sudo dnssec-signzone -A -3 $(head -c 1000 /dev/urandom | sha256sum | cut -b 1-16) -N INCREMENT -o janmg.com -z -t /etc/bind/zone/janmg.com
cat /etc/bind/zone/janmg.com
SERIAL=$(/usr/sbin/named-checkzone janmg.com /etc/bind/zone/janmg.com | egrep -ho '[0-9]{10}')
DATE=$(date -u +"%Y%m%d")
if [[ "${SERIAL}" =~ "${DATE}".* ]];
then
sed -i 's/'$SERIAL'/'$(($SERIAL+1))'/' /etc/bind/zone/janmg.com
else
sed -i 's/'$SERIAL'/'${DATE}01'/' /etc/bind/zone/janmg.com
fi
chown named:named /var/bind/K* chown named:named /etc/bind/zone tail -f /var/log/named/janmg.log sudo dnssec-dsfromkey -2 -f /etc/bind/zone/janmg.com.signed janmg.com
https://account.dyn.com/dns/domain-registration/dnssec.html?name=janmg.com
dig A janmg.com. +noadditional +dnssec +multiline
https://dnssec-debugger.verisignlabs.com/janmg.com
https://www.cloudflare.com/dns/dnssec/how-dnssec-works/
https://blog.webernetz.net/dnssec-zsk-key-rollover/
https://account.dyn.com/dns/domain-registration/dnssec.html?name=janmg.com
https://manager.linode.com/dns/domain%5Fslave/janmg%2Ecom
https://dnssec-debugger.verisignlabs.com/janmg.com
http://dnsviz.net/d/janmg.com/dnssec/
DNS Key
DNSKEY - Contains a public signing key (KSK)
DS - Contains the hash of a DNSKEY record
KSK Key-Signing Keys
ZSK Zone-Signing Keys
RRSIG - Contains a cryptographic signature
RRset - Same resource type
NSEC and NSEC3 - For explicit denial-of-existence of a DNS record
Ubuntu: AppArmor
KSK
Key Signing Keys are used for signing the zone keys, their DS'es are registered in the dns hierarchy above.
cd /var/bind/
KSK=$(dnssec-keygen -f KSK -a NSEC3RSASHA1 -b 4096 -n ZONE janmg.com)
dnssec-settime -I +12mo -D +13mo ${KSK}
ZSK
ZSK1=$(dnssec-keygen -a NSEC3RSASHA1 -b 4096 -n ZONE janmg.com)
dnssec-settime -I +4mo -D +5mo ${ZSK1}.key
ZSK2=$(dnssec-keygen -a NSEC3RSASHA1 -b 4096 -n ZONE janmg.com)
dnssec-settime -A +3mo -I +7mo -D +8mo ${ZSK2}.key
rm -rf /etc/bind/zone/janmg.com.signed*
dnssec-signzone -A -3 $(head -c 64 /dev/urandom | sha256sum | cut -b 1-64) -N date -o janmg.com -t -S -K /var/bind/ /etc/bind/zone/janmg.com
service bind9 reload
tail -20f /var/log/named/janmg.log
Update KSK on DYN
dnssec-dsfromkey -2 -f /etc/bind/zone/janmg.com.signed janmg.com
cd /var/bind/
KSK=$(dnssec-keygen -f KSK -a NSEC3RSASHA1 -b 4096 -n ZONE janmg.com 2> /dev/null)
dnssec-settime -I +5y -D +10y ${KSK}.key
dnssec-dsfromkey -2 -f /etc/bind/zone/janmg.com.signed janmg.com
ZSK1=$(dnssec-keygen -f KSK -a NSEC3RSASHA1 -b 4096 -n ZONE janmg.com 2> /dev/null)
dnssec-settime -I +4mo -D +5mo ${ZSK1}.key
ZSK2=$(dnssec-keygen -a NSEC3RSASHA1 -b 4096 -n ZONE janmg.com 2> /dev/null)
dnssec-settime -A +3mo -I +7mo -D +8mo ${ZSK2}.key
ZSK
dig A janmg.com. @localhost +noadditional +dnssec +multiline
Sign Zone
/usr/sbin/zonesigner.sh
dnssec-keygen -a NSEC3RSASHA1 -b 4096 -n ZONE janmg.com
sudo vi /etc/bind/zone/janmg.com
sudo service named restart
dnssec-signzone -A -3 $(head -c 1000 /dev/urandom | sha256sum | cut -b 1-16) -N INCREMENT -o janmg.com -t /etc/bind/zone/janmg.com
sudo dnssec-signzone -A -3 $(head -c 1000 /dev/urandom | sha256sum | cut -b 1-16) -N INCREMENT -o janmg.com -z -t /etc/bind/zone/janmg.com
cat /etc/bind/zone/janmg.com
SERIAL=$(/usr/sbin/named-checkzone janmg.com /etc/bind/zone/janmg.com | egrep -ho '[0-9]{10}')
DATE=$(date -u +"%Y%m%d")
if [[ "${SERIAL}" =~ "${DATE}".* ]];
then
sed -i 's/'$SERIAL'/'$(($SERIAL+1))'/' /etc/bind/zone/janmg.com
else
sed -i 's/'$SERIAL'/'${DATE}01'/' /etc/bind/zone/janmg.com
fi
dnssec-signzone -A -3 $(head -c 1000 /dev/urandom | sha256sum | cut -b 1-16) -N INCREMENT -o janmg.com -z -t /etc/bind/zone/janmg.com
service named reload dig DNSKEY janmg.com. @localhost +multiline dig A janmg.com. @localhost +noadditional +dnssec +multiline dig A janmg.com. +noadditional +dnssec +multiline
https://dnssec-debugger.verisignlabs.com/janmg.com
dig janmg.com soa cd /var/bind/ DNSKEY=$(dnssec-keygen -f KSK -a NSEC3RSASHA1 -b 4096 -n ZONE janmg.com 2> /dev/null) dig DNSKEY janmg.com. @localhost +multiline
Systemd resolved
sudo service systemd-resolved restart sudo systemd-resolve --status vi /etc/netplan/01-netcfg.yaml netplan generate netplan apply
ZSK Rollover
0 6 1 feb,jun,oct * dnssec-reverb -s zsk-add example.org 0 6 1 mar,jul,nov * dnssec-reverb -s zsk-roll example.org 0 6 1 apr,aug,dec * dnssec-reverb -s zsk-rmold example.org