DNSSEC Continued . . . Windows 2008R2 as Primary

 Network Security, Security
Jul 052011

I’ll be honest, I’m not a big fan of the Windows DNS service.  There are cases where an organization might want to use the Windows DNS service as a primary for their Internet facing zones.  I wanted to see how DNSSEC was setup on Windows and if Bind 9 could slave off of it.  Turns out it works fine.  This is the second of two posts on DNSSEC, the first post can be viewed here and dealt with setting up a Bind 9 primary server with DNSSEC.

Most of what I did here is documented in the Microsoft DNSSEC guide.  It’s really long and it took a lot of reading to figure out what really needed to be done. (tl;dr)  It’s a good idea to have this document handy if you are working on this.  Broken down, the process is roughly the same as Bind 9.

  • Build your zone files.
  • Create a KSK, and ZSK.
  • Sign the zone file.
  • Reconfigure DNS server to use the signed file.
  • Slave your other servers.
  • Send DS key to registrar
  • Test.

The Windows DNSSEC implementation has a few differences from Bind, first you can’t sign dynamic DNS zones (Bind can.)  Otherwise it works almost the same, as long as you are willing to hand-edit the zone files (they are pretty much the same format as Bind, so if you know that it is dead simple.)  I am not going to cover the maintenance of DNSSEC zones on Windows, basically the process is edit your source zone, increment the serial number, re-sign, and tell the service to reload the zone configuration.  Easy enough.

Here’s the zone I’ll be working with . . .

First step is to create your Key Signing Key: Continue reading »

Posted by tag on July 5, 2011

DNSSEC on Bind 9.7

 Network Security, Security
Jun 302011

I have been reading about DNSSEC and decided to do some quick testing.

One of the questions I had was, what happens with slave nameservers?  How does DNSSEC work with a slave?  Does it need copies of keys?  If my hosting provider is slaved off of me, and running Bind 9.x what extra steps need to be taken to enable DNSSEC.  Well the answer to that turned out to be really simple.  The slave servers don’t work any different than normal–all of the signing and key management is inside the zone file.

Setting up the signed zones isn’t really as hard as you might expect.  There are a few concepts you have to understand:

  • DNSSEC relies on a chain of trust based on public key cryptography.
  • It uses encryption for validation, not privacy.
  • You will most likely use a couple of public/private keys, one for signing keys, and one for signing zones.
  • The parent zone must have information about your key signing key, this is done with a DS resource record, it’s just a hash of the key signing public key in a DNS record.
  • Why two keys?  By using a key signing key and zone signing key, you can rotate the key used for signing the zone without having to notify your parent zone.

So setting it up goes something like this: Continue reading »

Posted by tag on June 30, 2011