Portál AbcLinuxu, 21. května 2024 23:40
root@localhost ~ $ dig +dnssec www.dnssec.cz @217.31.204.130 ; <<>> DiG 9.7.3 <<>> +dnssec www.dnssec.cz @217.31.204.130 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53540 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 512 ;; QUESTION SECTION: ;www.dnssec.cz. IN A ;; ANSWER SECTION: www.dnssec.cz. 5989 IN A 217.31.205.51 www.dnssec.cz. 5989 IN RRSIG A 5 3 7200 20120106080302 20111223080302 35132 dnssec.cz. qWrCG1addt67i3O3DuSLPFwS+LC0f/ZtC/3EqUh2vy32S5RheW8i1tjb PJQzJbgWXqXOpszZSpYbV8ljexDibfLEdXtallB1Cjo+4I+82bfvBigz nKn+6juvmipZJu/0ottqwKAWiWsXd4Aq6TyhqD6paIiP12zHIzsp0zHz 8u4= ;; Query time: 17 msec ;; SERVER: 217.31.204.130#53(217.31.204.130) ;; WHEN: Fri Dec 23 20:38:28 2011 ;; MSG SIZE rcvd: 227 root@localhost ~ $mam pocit, ze to nefunguje. Takhle to vypada na muj vlastni DNS:
root@localhost ~ $ dig +dnssec www.dnssec.cz ; <<>> DiG 9.7.3 <<>> +dnssec www.dnssec.cz ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65347 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 14, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; QUESTION SECTION: ;www.dnssec.cz. IN A ;; ANSWER SECTION: www.dnssec.cz. 5886 IN A 217.31.205.51 www.dnssec.cz. 5886 IN RRSIG A 5 3 7200 20120106080302 20111223080302 35132 dnssec.cz. qWrCG1addt67i3O3DuSLPFwS+LC0f/ZtC/3EqUh2vy32S5RheW8i1tjb PJQzJbgWXqXOpszZSpYbV8ljexDibfLEdXtallB1Cjo+4I+82bfvBigz nKn+6juvmipZJu/0ottqwKAWiWsXd4Aq6TyhqD6paIiP12zHIzsp0zHz 8u4= ;; AUTHORITY SECTION: . 20848 IN NS l.root-servers.net. . 20848 IN NS j.root-servers.net. . 20848 IN NS c.root-servers.net. . 20848 IN NS a.root-servers.net. . 20848 IN NS m.root-servers.net. . 20848 IN NS i.root-servers.net. . 20848 IN NS b.root-servers.net. . 20848 IN NS k.root-servers.net. . 20848 IN NS d.root-servers.net. . 20848 IN NS g.root-servers.net. . 20848 IN NS h.root-servers.net. . 20848 IN NS e.root-servers.net. . 20848 IN NS f.root-servers.net. . 20848 IN RRSIG NS 8 0 518400 20111229000000 20111221230000 55231 . eQkU+1mKLtARWwsN3aXE8jIL8EPkLwUE11FKEbrmNC6EWkTL7/ursLio NFcwtP37EroHzWQY3BQnsvLcjoTdXXJ3ijQy6aqlBRjqpwgx2BflKJCN 16WyxqeSnyz66IwUjEQICFf3k3Aa/HNJRGXu6mq8Vc3vPm2jIUdYJi+E LwQ= ;; Query time: 3 msec ;; SERVER: 192.168.1.1#53(192.168.1.1) ;; WHEN: Fri Dec 23 20:40:11 2011 ;; MSG SIZE rcvd: 596 root@localhost ~ $Co delam spatne?
JAK NASTAVIT VEŘEJNÉ DNS SERVERY CZ.NIC Veřejné DNS servery CZ.NIC jsou zabezpečeny pomocí technologie DNSSEC, která brání útokům na domény a podvržení falešných stránek. Více o rizicích nezabezpečeých domén najdete na webu Bezpečné domény. Můžete je bezplatně využívat, pokud Váš poskytovatel připojení k internetu zabezpečení pomocí DNSSEC nenabízí. JAK PROVÉST NASTAVENÍ? V konfiguraci síťového připojení nastavte servery s IP adresami 217.31.204.130 a 217.31.204.131, pokud vaše síťové připojení funguje i přes protokol IPv6 můžete použít i IPv6 adresy 2001:1488:800:400::130 a 2001:1488:800:400::131.Kde delam chybu? Jak to myslite s tim master serverem?
vyse uvedeny server je resolver a na tom to funguje viz vypis z digu
[hates@hp6910p ~]$ dig www.dnssec.cz @217.31.204.130 +dnssec ; <<>> DiG 9.8.1-P1-RedHat-9.8.1-3.P1.fc15 <<>> www.dnssec.cz @217.31.204.130 +dnssec ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12473 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; QUESTION SECTION: ;www.dnssec.cz. IN A ;; ANSWER SECTION: www.dnssec.cz. 4086 IN A 217.31.205.51 www.dnssec.cz. 4086 IN RRSIG A 5 3 7200 20120106080302 20111223080302 35132 dnssec.cz. qWrCG1addt67i3O3DuSLPFwS+LC0f/ZtC/3EqUh2vy32S5RheW8i1tjb PJQzJbgWXqXOpszZSpYbV8ljexDibfLEdXtallB1Cjo+4I+82bfvBigz nKn+6juvmipZJu/0ottqwKAWiWsXd4Aq6TyhqD6paIiP12zHIzsp0zHz 8u4= ;; AUTHORITY SECTION: dnssec.cz. 4086 IN NS b.ns.nic.cz. dnssec.cz. 4086 IN NS a.ns.nic.cz. dnssec.cz. 4086 IN RRSIG NS 5 2 7200 20120106080302 20111223080302 35132 dnssec.cz. JD160+5E7nLKhEot3bugrIk51+BuV5kfTl7nsBwYA36uYm6cyS7PiQCH JbxoZbkB4Yi0Q1GfOtgArexuD3FRL5G23Oi46B+omOp7NaZxFGlD9Q8u JyFKhL7mQSjXlk4YBquAnlXcjeKZBksTYtIVyE2OPH7rP3WKv/NJa/W2 84o= ;; Query time: 81 msec ;; SERVER: 217.31.204.130#53(217.31.204.130) ;; WHEN: Sat Dec 24 14:24:45 2011 ;; MSG SIZE rcvd: 435
$ dig www.dnssec.cz @217.31.204.130 +dnssec ; <<>> DiG 9.7.3 <<>> www.dnssec.cz @217.31.204.130 +dnssec ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22500 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 512 ;; QUESTION SECTION: ;www.dnssec.cz. IN A ;; ANSWER SECTION: www.dnssec.cz. 7161 IN A 217.31.205.51 www.dnssec.cz. 7161 IN RRSIG A 5 3 7200 20120106080302 20111223080302 35132 dnssec.cz. qWrCG1addt67i3O3DuSLPFwS+LC0f/ZtC/3EqUh2vy32S5RheW8i1tjb PJQzJbgWXqXOpszZSpYbV8ljexDibfLEdXtallB1Cjo+4I+82bfvBigz nKn+6juvmipZJu/0ottqwKAWiWsXd4Aq6TyhqD6paIiP12zHIzsp0zHz 8u4= ;; Query time: 26 msec ;; SERVER: 217.31.204.130#53(217.31.204.130) ;; WHEN: Sat Dec 24 14:49:34 2011 ;; MSG SIZE rcvd: 227 $Taky je zvlastni, ze mi to funguje (teda bez AD) i na vymysleny DNS server:
$ dig www.dnssec.cz @1.2.3.4 +dnssec ; <<>> DiG 9.7.3 <<>> www.dnssec.cz @1.2.3.4 +dnssec ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32245 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 512 ;; QUESTION SECTION: ;www.dnssec.cz. IN A ;; ANSWER SECTION: www.dnssec.cz. 7001 IN A 217.31.205.51 www.dnssec.cz. 7001 IN RRSIG A 5 3 7200 20120106080302 20111223080302 35132 dnssec.cz. qWrCG1addt67i3O3DuSLPFwS+LC0f/ZtC/3EqUh2vy32S5RheW8i1tjb PJQzJbgWXqXOpszZSpYbV8ljexDibfLEdXtallB1Cjo+4I+82bfvBigz nKn+6juvmipZJu/0ottqwKAWiWsXd4Aq6TyhqD6paIiP12zHIzsp0zHz 8u4= ;; Query time: 19 msec ;; SERVER: 1.2.3.4#53(1.2.3.4) ;; WHEN: Sat Dec 24 14:52:14 2011 ;; MSG SIZE rcvd: 227 $Jak je to mozne?
traceroute -p 53 --udp 1.2.3.4
$ traceroute -p 53 --udp 1.2.3.4 traceroute to 1.2.3.4 (1.2.3.4), 30 hops max, 60 byte packets 1 gateway (192.168.1.1) 1.608 ms 2.446 ms 2.433 ms 2 192.168.103.254 (192.168.103.254) 2.362 ms 2.598 ms 3.910 ms 3 192.168.123.254 (192.168.123.254) 4.194 ms 4.421 ms 5.319 ms 4 1.2.3.4 (1.2.3.4) 6.706 ms 6.647 ms 6.628 ms 5 1.2.3.4 (1.2.3.4) 12.033 ms 12.033 ms 12.020 ms 6 1.2.3.4 (1.2.3.4) 12.005 ms 10.144 ms 8.490 ms 7 1.2.3.4 (1.2.3.4) 9.588 ms 9.575 ms 16.684 ms 8 1.2.3.4 (1.2.3.4) 23.910 ms 23.917 ms 59.540 ms 9 1.2.3.4 (1.2.3.4) 31.681 ms 31.700 ms 31.679 ms 10 1.2.3.4 (1.2.3.4) 25.880 ms 25.888 ms 25.882 ms 11 * * * 12 * * * 13 * * * 14 * * * 15 * * * 16 * * * 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * *
Tiskni
Sdílej:
ISSN 1214-1267, (c) 1999-2007 Stickfish s.r.o.