Linux – Bind DNSSEC
1 – Gerar a chave e assinar
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
[root@centos7]# cd /var/named [root@centos7]# dnssec-keygen -r /dev/urandom -f KSK -a RSASHA1 -b 1024 -n ZONE labs.eti.br [root@centos7]# dnssec-signzone -S -z -o labs.eti.br db.labs.eti.br Fetching KSK/ZSK 14212/RSASHA1 from key repository. Verifying the zone using the following algorithms: RSASHA1. Zone fully signed: Algorithm: RSASHA1: KSKs: 1 active, 0 stand-by, 0 revoked ZSKs: 0 active, 0 stand-by, 0 revoked db.labs.eti.br.signed [root@centos7 named]# ll *eti.br* -rw-r--r-- 1 root root 543 Feb 19 06:57 db.labs.eti.br -rw-r--r-- 1 root root 7569 Feb 25 10:17 db.labs.eti.br.signed -rw-r--r-- 1 root root 167 Feb 25 10:17 dsset-labs.eti.br. -rw-r--r-- 1 root root 430 Feb 18 21:12 Klabs.eti.br.+005+14212.key -rw------- 1 root root 1010 Feb 18 21:12 Klabs.eti.br.+005+14212.private |
Observação Toda alteração feita no db.labs.eti.br deve após ser assinada e reiniciar o bind para a alteração entrar em vigor, caso contrário irá notar que toda alteração não irá entrar em vigor
|
1 2 3 4 5 6 7 8 9 10 |
[root@centos7]# dnssec-signzone -S -z -o labs.eti.br db.labs.eti.br dnssec-signzone: warning: dns_dnssec_findmatchingkeys: error reading key file Klabs.eti.br.+157+38276.private: bad key type Fetching KSK/ZSK 14212/RSASHA1 from key repository. Verifying the zone using the following algorithms: RSASHA1. Zone fully signed: Algorithm: RSASHA1: KSKs: 1 active, 0 stand-by, 0 revoked ZSKs: 0 active, 0 stand-by, 0 revoked db.labs.eti.br.signed [root@centos7]# systemctl restart named |
2 – Adicionar os parametros no named.conf e alterar o file
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
[root@centos7]# vim /etc/named.conf /* DNSSEC */ dnssec-enable yes; dnssec-validation yes; dnssec-lookaside auto; zone "labs.eti.br" { type master; # file "db.labs.eti.br"; file "db.labs.eti.br.signed"; allow-update { key rndc-key; }; allow-transfer { 35.196.13.28; 10.142.0.3; }; }; [root@centos7]# systemctl restart named |
…
Continue reading →