DNS BIND之dnssec安全实例配置-dev节点(dev.)

梦里梦外; 2022-08-07 14:59 320阅读 0赞

[上一节][Link 1]我们演示了根节点的dnssec配置，下面我们配置dev节点的dnssec。

dev服务器：192.168.110.71

**一、配置dev服务器  
1.生成签名密钥对**  
\# cd /var/named  
首先为区（zone）文件生成密钥签名密钥KSK：  
\#~/bind/sbin/dnssec-keygen -f KSK -a RSASHA1 -b 512 -n ZONE  dev.  
将生成文件Kdev.+005+44248.key公钥和Kdev.+005+44248.private私钥  
然后生成区签名密钥ZSK：  
\#~/bind/sbin/dnssec-keygen -a RSASHA1 -b 512 -n ZONE  dev.  
将生成文件Kdev.+005+41787.key公钥和Kdev.+005+44248.private私钥  
**2.签名zone**  
a.签名之前将前面生成的两个公钥添加到区域配置文件末尾

$TTL 86400
    @       IN      SOA     @       root.dev (
                                                            2
                                                            1m
                                                            1m
                                                            1m
                                                            1m)
    dev.            IN              NS      ns.dev.
    ns.dev.         IN              A       192.168.110.71
    abc.dev.        IN              A       192.168.100.90
    
    $INCLUDE "Kdev.+005+41787.key"
    $INCLUDE "Kdev.+005+44248.key"

b.执行签名操作  
\#~/bind/sbin/dnssec-signzone -o dev. dev.zone  
生成dev.zone.signed签名zone  
**3.修改主配置文件name.conf**

key "rndc-key" {
            algorithm hmac-md5;
            secret "etMaaS+O06WFFUHxKAaTXA==";
    };
    
    controls {
            inet 127.0.0.1 port 953
                    allow { 127.0.0.1; } keys { "rndc-key"; };
    };
    options{
            listen-on port 53{
                    192.168.110.71;
            };
            version "vdns3.0";
            directory "/var/named";
            pid-file "/var/run/named.pid";
            session-keyfile "/var/run/session.key";
            dump-file "/var/named/data/cache_dump.db";
            statistics-file "/var/named/data/named_stats.txt";
            memstatistics-file "/var/named/data/named_mem_stats.txt";
            rrset-order { 
                    order cyclic;
            }; 
            recursion no;
            allow-query{
                    any;
            };
            allow-query-cache{
                    any;
            };
            allow-transfer{
                    none;
            }; 
            dnssec-enable yes;
            dnssec-validation yes;
            dnssec-lookaside auto;
    
            /* Path to ISC DLV key */
            bindkeys-file "/etc/named.iscdlv.key";
            managed-keys-directory "/var/named/dynamic";
    };
    
    logging { 
            channel default_debug {
                    file "/var/named/data/named.run";
                    severity dynamic;
            };
            channel queries_info { 
                    file "/var/named/log/query.log" versions 1 size 100m; 
                    severity info; 
                    print-category yes; 
                    print-severity yes; 
                    print-time yes; 
            }; 
     
            category queries { 
                    queries_info; 
                    default_debug; 
            }; 
     
            channel notify_info { 
                    file "/var/named/log/notify.log" versions 8 size 128m; 
                    severity info; 
                    print-category yes; 
                    print-severity yes; 
                    print-time yes; 
            }; 
     
            category notify { 
                    notify_info; 
                    default_debug; 
            };
            channel dnssec_debug {
                    file "/var/named/log/dnssec.log" versions 1 size 100m;
                    print-time yes;
                    print-category yes;
                    print-severity yes;
                    severity debug 3;
            }; 
            category dnssec { 
                    dnssec_debug; 
            };
    }; 
    
    zone "." in {
            type hint;
            file "root.zone";
    };
    zone "dev." IN {  
            type master;  
            file "dev.zone.signed";  
    };

检查配置是否正确：  
/home/slim/bind/sbin/named-checkconf -t /home/slim/chroot/ /etc/named.conf

**4.启动服务**  
/home/slim/bind/sbin/named -u slim -t /home/slim/chroot/ -c /etc/named.conf

二、配置根服务器  
1.将生成的dsset-dev.发给根服务器，在192.168.110.71上执行  
\# cd /var/named  
\# scp dsset-dev. slim@192.168.13.103:/home/slim/chroot/var/named/  
2.在192.168.13.103上执行  
\# cd /var/named  
\# vi root.zone

3.在该文件末尾添加 $INCLUDE "dsset-dev."

$TTL 86400
    @           IN   SOA    @       root (
                                                            12169
                                                            1m
                                                            1m
                                                            1m
                                                            1m )
    .                       IN      NS      root.ns.
    root.ns.        IN      A       192.168.13.103
    dev.            IN      NS      ns.dev.
    ns.dev.         IN      A       192.168.110.71
     
    $INCLUDE "K.+005+62541.key"
    $INCLUDE "K.+005+62317.key"
    $INCLUDE "dsset-dev."

4.然后在根服务器上重新对区文件进行签名  
\# mv  root.zone.signed  root.zone.signed.bak  
\# /home/slim/bind/sbin/dnssec-signzone  -o  .  root.zone  
5.重启根服务  
三、测试  
在递归解析服务执行：  
dig @192.168.13.45 +dnssec dev. NS

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6_6.2 <<>> @192.168.13.45 +dnssec dev. NS
    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49047
    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 3
    
    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags: do; udp: 4096
    ;; QUESTION SECTION:
    ;dev.                           IN      NS
    
    ;; ANSWER SECTION:
    dev.                    80410   IN      NS      ns.dev.
    dev.                    86386   IN      RRSIG   NS 5 1 86400 20150517074758 20150417074758 41787 dev. x3QO8JsFscxB7t9SQjtjdZCXyjUkdWNbCfOSUxPyZZPb3jRt/DOYN0lR hKJqgl8VT2T2D1P3kmr8O7ptGlTKpg==
    
    ;; ADDITIONAL SECTION:
    ns.dev.                 80410   IN      A       192.168.110.71
    ns.dev.                 86386   IN      RRSIG   A 5 2 86400 20150517074758 20150417074758 41787 dev. a9f04XI5VUvgoDdJa5BoN3GEhA2Po+Iqo9GLgcw0S5Sts7Hw/dIm/EOF lj8oCXUniBgQdRzWw+0QzYvUavGYxg==
    
    ;; Query time: 0 msec
    ;; SERVER: 192.168.13.45#53(192.168.13.45)
    ;; WHEN: Fri Apr 17 02:05:49 2015
    ;; MSG SIZE  rcvd: 263

dig @192.168.13.45 +dnssec abc.dev. A

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6_6.2 <<>> @192.168.13.45 +dnssec abc.dev. A
    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20230
    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 3
    
    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags: do; udp: 4096
    ;; QUESTION SECTION:
    ;abc.dev.                       IN      A
    
    ;; ANSWER SECTION:
    abc.dev.                86375   IN      A       192.168.100.90
    abc.dev.                86375   IN      RRSIG   A 5 2 86400 20150517074758 20150417074758 41787 dev. aSP+yVyu83pPlwZ8iSoyFydzSOugMLnNV5ZcbObJ+U6qWj8j9AF4Baxy zxqKiSkTDkx16yjgnzdGINwfgFt1EA==
    
    ;; AUTHORITY SECTION:
    dev.                    80152   IN      NS      ns.dev.
    dev.                    86128   IN      RRSIG   NS 5 1 86400 20150517074758 20150417074758 41787 dev. x3QO8JsFscxB7t9SQjtjdZCXyjUkdWNbCfOSUxPyZZPb3jRt/DOYN0lR hKJqgl8VT2T2D1P3kmr8O7ptGlTKpg==
    
    ;; ADDITIONAL SECTION:
    ns.dev.                 80152   IN      A       192.168.110.71
    ns.dev.                 86375   IN      RRSIG   A 5 2 86400 20150517074758 20150417074758 41787 dev. a9f04XI5VUvgoDdJa5BoN3GEhA2Po+Iqo9GLgcw0S5Sts7Hw/dIm/EOF lj8oCXUniBgQdRzWw+0QzYvUavGYxg==
    
    ;; Query time: 0 msec
    ;; SERVER: 192.168.13.45#53(192.168.13.45)
    ;; WHEN: Fri Apr 17 02:10:07 2015
    ;; MSG SIZE  rcvd: 382

注：配置具体域名的dnssec也是类型，生成zone签名，将dsset-\*添加到上一节点zone中，并重新签名。

[Link 1]: http://blog.csdn.net/zhu_tianwei/article/details/45075577