Difference between revisions of "DNSSEC"

From ArchWiki
Jump to: navigation, search
(OpenSSH (fixes only weak point in SSH design))
(13 intermediate revisions by 4 users not shown)
Line 1: Line 1:
[[Category:Security (English)]]
+
[[Category:Security]]
[[Category:Networking (English)]]
+
[[Category:Domain Name System]]
[[Category:Web Server (English)]]
+
  
 +
{{Poor writing}}
 
{{stub}}
 
{{stub}}
  
Line 16: Line 16:
  
 
== DNSSEC Packages ==
 
== DNSSEC Packages ==
* '''dnssec-root-zone-trust-anchors''' http://aur.archlinux.org/packages.php?ID=39315
+
{{Merge|DNSSEC#Howto enable DNSSEC in specific software|Duplicated information}}
 +
* {{pkg|dnssec-anchors}}
 
** essential package contains keys to internet from [https://www.iana.org/dnssec/ IANA] stored in /usr/share/dnssec-trust-anchors/
 
** essential package contains keys to internet from [https://www.iana.org/dnssec/ IANA] stored in /usr/share/dnssec-trust-anchors/
 
** VERY important!
 
** VERY important!
Line 30: Line 31:
 
***** '''drill -TD badsign-a.test.dnssec-tools.org'''
 
***** '''drill -TD badsign-a.test.dnssec-tools.org'''
 
**** to use root-zone trust anchor add option '''-k /usr/share/dnssec-trust-anchors/root-anchor.key'''
 
**** to use root-zone trust anchor add option '''-k /usr/share/dnssec-trust-anchors/root-anchor.key'''
* '''dnssec-tools''' http://aur.archlinux.org/packages.php?ID=39294 ''(package is very experimental and volatile right now)''
+
* {{aur|dnssec-tools}} ''(package is very experimental and volatile right now)''
 
** https://www.dnssec-tools.org/
 
** https://www.dnssec-tools.org/
 
** another good library '''libval''' which can add DNSSEC support to lots of programs
 
** another good library '''libval''' which can add DNSSEC support to lots of programs
Line 38: Line 39:
 
** '''libval-shim''' LD_PRELOAD library to enable DNSSEC for lots of DNSSEC unaware programs http://www.dnssec-tools.org/docs/tool-description/libval_shim.html
 
** '''libval-shim''' LD_PRELOAD library to enable DNSSEC for lots of DNSSEC unaware programs http://www.dnssec-tools.org/docs/tool-description/libval_shim.html
 
** [[PERL]] API
 
** [[PERL]] API
* '''dnsval''' https://aur.archlinux.org/packages.php?ID=55830
+
* {{aur|openssh-dnssec}}
** C libraries that implement DNSSEC aware DNS resolution APIs from the DNSSEC-tools project. Provides libval, libres, and the aforementioned libval-shim.
+
* '''openssh-dnssec''' http://aur.archlinux.org/packages.php?ID=39296
+
 
** see lower on this page
 
** see lower on this page
* '''sshfp''' http://aur.archlinux.org/packages.php?ID=29185
+
* {{aur|sshfp}}
 
** Generates DNS SSHFP-type records from SSH public keys from public keys from a known_hosts file or from scanning the host's sshd daemon.
 
** Generates DNS SSHFP-type records from SSH public keys from public keys from a known_hosts file or from scanning the host's sshd daemon.
 
** not directly related to DNSSEC, but i guess this will become very popular because of DNSSEC
 
** not directly related to DNSSEC, but i guess this will become very popular because of DNSSEC
* '''opendnssec''' http://aur.archlinux.org/packages.php?ID=55926
+
* {{aur|opendnssec}}
 
** Signs DNS zones to be later published by a DNS server (bind, nsd, etc.)
 
** Signs DNS zones to be later published by a DNS server (bind, nsd, etc.)
 
** Automates refreshing signatures, key rollovers
 
** Automates refreshing signatures, key rollovers
  
 
== Howto enable DNSSEC in specific software ==
 
== Howto enable DNSSEC in specific software ==
 +
 +
{{Merge|DNSSEC#DNSSEC Packages|Duplicated information}}
  
 
If you want full support of DNSSEC, you need each single application to use DNSSEC validation. It can be done using several ways:
 
If you want full support of DNSSEC, you need each single application to use DNSSEC validation. It can be done using several ways:
Line 65: Line 66:
 
* dnssec-tools + patch: https://www.dnssec-tools.org/wiki/index.php/Ssh
 
* dnssec-tools + patch: https://www.dnssec-tools.org/wiki/index.php/Ssh
 
** http://www.dnssec-tools.org/readme/README.ssh
 
** http://www.dnssec-tools.org/readme/README.ssh
* openssh-dnssec wrapper http://aur.archlinux.org/packages.php?ID=39296
+
* {{aur|openssh-dnssec}} wrapper
 
** DNSSEC (ldns) wrapper for OpenSSH client.
 
** DNSSEC (ldns) wrapper for OpenSSH client.
 
** instantly adds minimal DNSSEC support to ssh (no SSHFP support).
 
** instantly adds minimal DNSSEC support to ssh (no SSHFP support).
Line 112: Line 113:
 
* no patches yet
 
* no patches yet
 
* Vote for [http://developer.pidgin.im/ticket/12413 #12413]
 
* Vote for [http://developer.pidgin.im/ticket/12413 #12413]
 
  
 
== DNSSEC Hardware ==
 
== DNSSEC Hardware ==

Revision as of 08:58, 13 October 2012


Tango-edit-clear.pngThis article or section needs language, wiki syntax or style improvements.Tango-edit-clear.png

Reason: please use the first argument of the template to provide a brief explanation. (Discuss in Talk:DNSSEC#)

Tango-document-new.pngThis article is a stub.Tango-document-new.png

Notes: please use the first argument of the template to provide more detailed indications. (Discuss in Talk:DNSSEC#)

Facts

DNSSEC Packages

Merge-arrows-2.pngThis article or section is a candidate for merging with DNSSEC#Howto enable DNSSEC in specific software.Merge-arrows-2.png

Notes: Duplicated information (Discuss in Talk:DNSSEC#)

Howto enable DNSSEC in specific software

Merge-arrows-2.pngThis article or section is a candidate for merging with DNSSEC#DNSSEC Packages.Merge-arrows-2.png

Notes: Duplicated information (Discuss in Talk:DNSSEC#)

If you want full support of DNSSEC, you need each single application to use DNSSEC validation. It can be done using several ways:


OpenSSH (fixes only weak point in SSH design)

Firefox (secure browsing - enchancment of HTTPS)

Chromium/Google Chrome (secure browsing - enchancment of HTTPS)

  • Vote for #50874
    • Patches not yet...
    • DNSSEC Drill extension (EXPERIMENTAL!)
      • you need ldns and dnssec-root-zone-trust-anchors packages for this plugin

BIND (serving signed DNS zones)

Postfix (fight spam and frauds)

  • dnssec-tools + patch

jabberd (fight spam and frauds)

  • dnssec-tools + patch

Thunderbird (secure logins)

  • dnssec-tools + patch

lftp (secure downloads and logins)

  • dnssec-tools + patch

wget (secure downloads)

  • dnssec-tools + patch

proftpd

  • dnssec-tools + patch

Sendmail (fight spam and frauds)

  • dnssec-tools + patch

LibSPF

  • dnssec-tools + patch

ncftp (secure downloads and logins)

  • dnssec-tools + patch

libpurple (pidgin + finch -> secure messaging)

  • no patches yet
  • Vote for #12413

DNSSEC Hardware

You can check if your router, modem, AP, etc. supports DNSSEC (many different features) using dnssec-tester (Python & GTK+ based app) to know if it is DNSSEC-compatible, and using this tool you can also upload gathered data to a server, so other users and manufacturers can be informed about compatibility of their devices and eventualy fix the firmware (they will be probably urged to do so). (Before running dnssec-tester please make sure, that you do not have any other nameservers in /etc/resolv.conf). You can also find the results of performed tests on the dnssec-tester website.

See Also