Dotaz: Funguje mi cz.nic dnssec server?

[123]

Ahoj zkousel jsem pouzit DNS server od CZ.NIC, ktery by mel podporavat DNSSEC.

root@localhost ~ $ dig +dnssec www.dnssec.cz @217.31.204.130

; <<>> DiG 9.7.3 <<>> +dnssec www.dnssec.cz @217.31.204.130
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53540
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;www.dnssec.cz.			IN	A

;; ANSWER SECTION:
www.dnssec.cz.		5989	IN	A	217.31.205.51
www.dnssec.cz.		5989	IN	RRSIG	A 5 3 7200 20120106080302 20111223080302 35132 dnssec.cz. qWrCG1addt67i3O3DuSLPFwS+LC0f/ZtC/3EqUh2vy32S5RheW8i1tjb PJQzJbgWXqXOpszZSpYbV8ljexDibfLEdXtallB1Cjo+4I+82bfvBigz nKn+6juvmipZJu/0ottqwKAWiWsXd4Aq6TyhqD6paIiP12zHIzsp0zHz 8u4=

;; Query time: 17 msec
;; SERVER: 217.31.204.130#53(217.31.204.130)
;; WHEN: Fri Dec 23 20:38:28 2011
;; MSG SIZE  rcvd: 227

root@localhost ~ $ 

mam pocit, ze to nefunguje. Takhle to vypada na muj vlastni DNS:

root@localhost ~ $ dig +dnssec www.dnssec.cz

; <<>> DiG 9.7.3 <<>> +dnssec www.dnssec.cz
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65347
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 14, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;www.dnssec.cz.			IN	A

;; ANSWER SECTION:
www.dnssec.cz.		5886	IN	A	217.31.205.51
www.dnssec.cz.		5886	IN	RRSIG	A 5 3 7200 20120106080302 20111223080302 35132 dnssec.cz. qWrCG1addt67i3O3DuSLPFwS+LC0f/ZtC/3EqUh2vy32S5RheW8i1tjb PJQzJbgWXqXOpszZSpYbV8ljexDibfLEdXtallB1Cjo+4I+82bfvBigz nKn+6juvmipZJu/0ottqwKAWiWsXd4Aq6TyhqD6paIiP12zHIzsp0zHz 8u4=

;; AUTHORITY SECTION:
.			20848	IN	NS	l.root-servers.net.
.			20848	IN	NS	j.root-servers.net.
.			20848	IN	NS	c.root-servers.net.
.			20848	IN	NS	a.root-servers.net.
.			20848	IN	NS	m.root-servers.net.
.			20848	IN	NS	i.root-servers.net.
.			20848	IN	NS	b.root-servers.net.
.			20848	IN	NS	k.root-servers.net.
.			20848	IN	NS	d.root-servers.net.
.			20848	IN	NS	g.root-servers.net.
.			20848	IN	NS	h.root-servers.net.
.			20848	IN	NS	e.root-servers.net.
.			20848	IN	NS	f.root-servers.net.
.			20848	IN	RRSIG	NS 8 0 518400 20111229000000 20111221230000 55231 . eQkU+1mKLtARWwsN3aXE8jIL8EPkLwUE11FKEbrmNC6EWkTL7/ursLio NFcwtP37EroHzWQY3BQnsvLcjoTdXXJ3ijQy6aqlBRjqpwgx2BflKJCN 16WyxqeSnyz66IwUjEQICFf3k3Aa/HNJRGXu6mq8Vc3vPm2jIUdYJi+E LwQ=

;; Query time: 3 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Fri Dec 23 20:40:11 2011
;; MSG SIZE  rcvd: 596

root@localhost ~ $ 

Co delam spatne?

Odpovědi

[hates]

ze by tim ze se dotazujete primo master serveru ? Proto tam nemate priznak AD. Domena dnssec.cz patri NICu. Me to taktez takto nefunguje, ale pokud se dotazete pres jiny server s podporou DNSSEC validace tak vam to bude fungovat.

[123]

Ja jsem prave myslel, ze 217.31.204.130 podporu DNSSEC ma.

JAK NASTAVIT VEŘEJNÉ DNS SERVERY CZ.NIC

Veřejné DNS servery CZ.NIC jsou zabezpečeny pomocí technologie DNSSEC, která brání útokům na domény a podvržení falešných stránek. Více o rizicích nezabezpečeých domén najdete na webu Bezpečné domény. Můžete je bezplatně využívat, pokud Váš poskytovatel připojení k internetu zabezpečení pomocí DNSSEC nenabízí.

JAK PROVÉST NASTAVENÍ?

V konfiguraci síťového připojení nastavte servery s IP adresami 217.31.204.130 a 217.31.204.131, pokud vaše síťové připojení funguje i přes protokol IPv6 můžete použít i IPv6 adresy 2001:1488:800:400::130 a 2001:1488:800:400::131.

Kde delam chybu?

Jak to myslite s tim master serverem?

[hates]

vyse uvedeny server je resolver a na tom to funguje viz vypis z digu

[hates@hp6910p ~]$ dig www.dnssec.cz @217.31.204.130 +dnssec

; <<>> DiG 9.8.1-P1-RedHat-9.8.1-3.P1.fc15 <<>> www.dnssec.cz @217.31.204.130 +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12473
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;www.dnssec.cz.			IN	A

;; ANSWER SECTION:
www.dnssec.cz.		4086	IN	A	217.31.205.51
www.dnssec.cz.		4086	IN	RRSIG	A 5 3 7200 20120106080302 20111223080302 35132 dnssec.cz. qWrCG1addt67i3O3DuSLPFwS+LC0f/ZtC/3EqUh2vy32S5RheW8i1tjb PJQzJbgWXqXOpszZSpYbV8ljexDibfLEdXtallB1Cjo+4I+82bfvBigz nKn+6juvmipZJu/0ottqwKAWiWsXd4Aq6TyhqD6paIiP12zHIzsp0zHz 8u4=

;; AUTHORITY SECTION:
dnssec.cz.		4086	IN	NS	b.ns.nic.cz.
dnssec.cz.		4086	IN	NS	a.ns.nic.cz.
dnssec.cz.		4086	IN	RRSIG	NS 5 2 7200 20120106080302 20111223080302 35132 dnssec.cz. JD160+5E7nLKhEot3bugrIk51+BuV5kfTl7nsBwYA36uYm6cyS7PiQCH JbxoZbkB4Yi0Q1GfOtgArexuD3FRL5G23Oi46B+omOp7NaZxFGlD9Q8u JyFKhL7mQSjXlk4YBquAnlXcjeKZBksTYtIVyE2OPH7rP3WKv/NJa/W2 84o=

;; Query time: 81 msec
;; SERVER: 217.31.204.130#53(217.31.204.130)
;; WHEN: Sat Dec 24 14:24:45 2011
;; MSG SIZE  rcvd: 435

[123]

Proc mne to porad nefunguje?

$ dig www.dnssec.cz @217.31.204.130 +dnssec

; <<>> DiG 9.7.3 <<>> www.dnssec.cz @217.31.204.130 +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22500
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;www.dnssec.cz.			IN	A

;; ANSWER SECTION:
www.dnssec.cz.		7161	IN	A	217.31.205.51
www.dnssec.cz.		7161	IN	RRSIG	A 5 3 7200 20120106080302 20111223080302 35132 dnssec.cz. qWrCG1addt67i3O3DuSLPFwS+LC0f/ZtC/3EqUh2vy32S5RheW8i1tjb PJQzJbgWXqXOpszZSpYbV8ljexDibfLEdXtallB1Cjo+4I+82bfvBigz nKn+6juvmipZJu/0ottqwKAWiWsXd4Aq6TyhqD6paIiP12zHIzsp0zHz 8u4=

;; Query time: 26 msec
;; SERVER: 217.31.204.130#53(217.31.204.130)
;; WHEN: Sat Dec 24 14:49:34 2011
;; MSG SIZE  rcvd: 227

$

Taky je zvlastni, ze mi to funguje (teda bez AD) i na vymysleny DNS server:

$ dig www.dnssec.cz @1.2.3.4 +dnssec

; <<>> DiG 9.7.3 <<>> www.dnssec.cz @1.2.3.4 +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32245
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;www.dnssec.cz.			IN	A

;; ANSWER SECTION:
www.dnssec.cz.		7001	IN	A	217.31.205.51
www.dnssec.cz.		7001	IN	RRSIG	A 5 3 7200 20120106080302 20111223080302 35132 dnssec.cz. qWrCG1addt67i3O3DuSLPFwS+LC0f/ZtC/3EqUh2vy32S5RheW8i1tjb PJQzJbgWXqXOpszZSpYbV8ljexDibfLEdXtallB1Cjo+4I+82bfvBigz nKn+6juvmipZJu/0ottqwKAWiWsXd4Aq6TyhqD6paIiP12zHIzsp0zHz 8u4=

;; Query time: 19 msec
;; SERVER: 1.2.3.4#53(1.2.3.4)
;; WHEN: Sat Dec 24 14:52:14 2011
;; MSG SIZE  rcvd: 227

$

Jak je to mozne?

[hates]

jak jste pripojen k internetu ?

Je mozne ze zarizeni, ktere pouzivate pro pripojeni, provadi preklad portu 53 na nejakou vnitrni adresu poskytovatele a tam jim bezi DNS server bez podpory DNSSEC. To by pote odpovidalo. Zkuste udelat traceroute na jakoukoliv adresu a port 53 a zjistete kam to muze dopadat.

traceroute -p 53 --udp 1.2.3.4

[123]

Je to nejake divne

$ traceroute -p 53 --udp 1.2.3.4
traceroute to 1.2.3.4 (1.2.3.4), 30 hops max, 60 byte packets
 1  gateway (192.168.1.1)  1.608 ms  2.446 ms  2.433 ms
 2  192.168.103.254 (192.168.103.254)  2.362 ms  2.598 ms  3.910 ms
 3  192.168.123.254 (192.168.123.254)  4.194 ms  4.421 ms  5.319 ms
 4  1.2.3.4 (1.2.3.4)  6.706 ms  6.647 ms  6.628 ms
 5  1.2.3.4 (1.2.3.4)  12.033 ms  12.033 ms  12.020 ms
 6  1.2.3.4 (1.2.3.4)  12.005 ms  10.144 ms  8.490 ms
 7  1.2.3.4 (1.2.3.4)  9.588 ms  9.575 ms  16.684 ms
 8  1.2.3.4 (1.2.3.4)  23.910 ms  23.917 ms  59.540 ms
 9  1.2.3.4 (1.2.3.4)  31.681 ms  31.700 ms  31.679 ms
10  1.2.3.4 (1.2.3.4)  25.880 ms  25.888 ms  25.882 ms
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *