Internet Initiative Japan Inc. · TSE:3774
Internet Initiative Japan — Internet Systems Consortium — Technical Presentation (January 2012)
35 slides from Internet Initiative Japan's technical presentation, Jan 11, 2012
Slide 1: Inline Signing in BIND 9.9
Inline Signing in BIND 9.9 Internet Systems Consortium January 11, 2012 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 2: About the Presenters
About the Presenters Michael Graff BIND 9 Engineering Manager [email protected] @skandragon Larissa Shapiro ISC Product Manager [email protected] @larissashapiro Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 3: Agenda
Agenda • Introductions & Logistics • ISC Overview • BIND 9.9: Inline Signing • ISC Services and DNSSEC • Questions 3 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 4: Logistics
Logistics • Attendees are muted but please feel free to ask questions using the Q & A panel or raise your “hand” to be called on to speak • Questions will be answered at several points in the webinar as well as at the end of the session. • An archive of this presentation and the slides will be avail
Slide 5: ISC in a Nutshell
ISC in a Nutshell Forum Professional Services Public Benefit Services • BIND • Consulting • DNS F-Root • BIND 10 Working Group • Training • DNS Secondary Server • DHCP • Software Support Services Resiliency (SNS-PB) • AFTR / PCP • Custom Software Development • Hosted@ - hosting a range of • SRF • F-
Slide 6: What is Inline Signing?
What is Inline Signing? •A BIND 9.9 server reads unsigned data, and signs it automatically •The source of the data can be another server (zone transfer) or a disk file •Probably usable by nearly everyone –Eliminates using dnssec-signzone –Simplifies DNSSEC deployment •It does not maintain keys, howe
Slide 7: Inline Signing Benefits
Inline Signing Benefits •Deploying DNSSEC •Use an IPAM or other source •Minimize cost •Minimize operational changes •Parallel production and testbed •Selective exposure 7 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 8: Any questions?
Any questions? ? Need help with ISC products? http://kb.isc.org -- ISC Knowledge Base email lists (bind-users, etc) Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 9: Hidden Master
Hidden Master •Hidden masters are very common. •Master server receives updates, and notifies slaves of changes. •Slave transfer from the master using AXFR and IXFR. •The master itself is not queried by resolvers. 9 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 10: Hidden Master
Hidden Master Normal transfer Slave - Notify - AXFR and IXFR Hidden Slave Master Slave 10 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 11: Inline Signing (slave model)
Inline Signing (slave model) Normal transfer Slave - Notify - AXFR and IXFR Hidden Inline Slave Master Signer Slave 11 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 12: Inline Signing (file model)
Inline Signing (file model) Normal transfer Slave - Notify - AXFR and IXFR Zone Inline Slave File Signer Slave 12 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 13: Any questions?
Any questions? ? Not using a hidden master? Doing something special? Contact ISC for support and consulting [email protected] Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 14: Configuration
Configuration So, how do we configure this stuff? Two models Slave model File model 14 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 15: Configuration
Configuration Enable Inline- inline-signing yes; Signing Enable DNSSEC auto-dnssec maintain; automatic signing Set key directory (optional) key-directory "keys"; inline-signing enables ixfr-from-differences 15 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 16: Slave Model
Slave Model In the slave model, a BIND 9.9 ser ver transfers the unsigned zone data from an existing DNS server. This server does not need to be BIND. We’d like it to be of course... 16 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 17: Slave Model Configuration
Slave Model Configuration zone "example.net" { type slave; Without masters { 1.2.3.4; }; Inline-Signing file "slave/example.net"; }; 17 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 18: Slave Model Configuration
Slave Model Configuration zone "example.net" { type slave; masters { 1.2.3.4; }; With file "slave/example.net"; Inline-Signing inline-signing yes; auto-dnssec maintain; key-directory "keys"; }; 18 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 19: File Model
File Model In the file model, a BIND 9.9 ser ver loads the unsigned zone data from a file on your disk. This allows manually editing your zone files, just like you may do today. This allows existing scripts to generate zone data. 19 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 20: File Model Configuration
File Model Configuration zone "example.net" { Without type master; Inline-Signing file "master/example.net"; }; 20 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 21: File Model Configuration
File Model Configuration zone "example.net" { type master; With file "master/example.net"; Inline-Signing inline-signing yes; auto-dnssec maintain; key-directory "keys"; }; 21 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 22: Key Generation
Key Generation $ cd /var/named $ dnssec-keygen -K ./keys -f KSK example.net $ dnssec-keygen -K ./keys example.net Check the directory statement in the options block. Set other key parameters as needed (length, key type, etc) 22 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 23: Key Management
Key Management •Key management is large topic. •Key generation and storage: –Use an HSM if you need to –Perhaps use an HSM for KSK, files for ZSK –Select appropriately sized keys •General key rolling guidelines: –Roll enough to know how, but not more often –Roll when there is a reason to. 23 Copyrig
Slide 24: Any questions?
Any questions? ? Wow, that was a lot to digest! Check http://kb.isc.org for inline-signing, DNSSEC, and many other topics We’ll have an inline-signing article up soon! Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 25: Reducing Risk
Reducing Risk DNSSEC is new. Many people do not have solid operational experience. DNSSEC is scary. Once your parent zone has your KSK, there’s no going back without causing failures. We suggest finding a safe approach. Each situation is unique. ISC is here to help. 25 Copyright (c) 2012 Internet Sy
Slide 26: Parallel Deployment
Parallel Deployment •Reduces risk by reducing changes –Existing infrastructure is mostly untouched •Add servers to handle the signed data –You might want to upgrade them anyway •Easy to switch back to unsigned –Maybe •Allows testbed or selective exposure 26 Copyright (c) 2012 Internet Systems Consor
Slide 27: Parallel Deployment
Parallel Deployment Hidden Master Current Slaves Inline Signer New Slaves 27 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 28: Gimme!
Gimme! •Early February for final release •Get the Release Candidate #1 today •Sign up for the bind-announce list to receive release notifications https://lists.isc.org/mailman/listinfo/bind-announce 28 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 29: Upcoming Training
Upcoming Training •2-Day Introductory DNS & BIND Training, Feb 6-7, Singapore •5-Day Intro & Advanced DNS & BIND Topics (incl. DNSSEC), Feb 6-10, Singapore •3-Day IPv6 Fundamentals Workshop, Feb 13-15, Melbourne, Australia •2-Day ISC DHCP Workshop, Feb 16-17, Melbourne, Australia •3-Day DNSSEC Imple
Slide 30: Upcoming Web Seminars
Upcoming Web Seminars Next Web Seminar: January 25, 2012 ISC Product Updates: BIND, DHCP, PCP, and more... what’s going to be hot at ISC in 2012 Please note that this webinar is offered as a benefit to ISC Members, Customers and Forum Sponsors only. If you would like to receive this benefit, please
Slide 31: Special Offer for Attendees
Special Offer for Attendees Choose one: 20% Off 20% Off 20% Off BIND Configuration Review for DNSSEC 5-day BIND with 3-day DNSSEC Readiness DNSSEC training training workshop consulting Training offers are valid for training sessions offered by ISC through June 30, 2012. You must sign up within 30 da
Slide 32: Keeping in Contact
Keeping in Contact http://www.facebook.com/InternetSystemsConsortium http://www.linkedin.com/company/internet-systems-consortium http://twitter.com/ISCdotORG 32 Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 33: ISC Resources
ISC Resources Knowledge Base for many things http://kb.isc.org/ bind-announce for release notifications http://lists.isc.org/mailman/listinfo/bind-announce bind-users for community assistance http://lists.isc.org/mailman/listinfo/bind-users 33 Copyright (c) 2012 Internet Systems Consortium http://ww
Slide 34: Questions?
Questions? ? Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Slide 35: Thank you for attending.
Thank you for attending. www.isc.org Copyright (c) 2012 Internet Systems Consortium http://www.isc.org/
Internet Systems Consortium — Technical Presentation (January 2012) on 6ix