DNSSEC启用和查找

Question

我遇到了一个绑定设置，其中只有一个DNSSEC值集，如下所示：

dnssec-validation yes;  

named.conf.options中的密钥声明如下：

include "/etc/bind.keys"

然而，其馀部分如下：

dnssec-enable yes;
dnssec-lookaside auto;

在任何地方都没有设定。

现在的问题是，这个设置是否有效？我在任何地方都没有看到任何错误。如有任何意见/建议/建议，将不胜感激。事先非常感谢！

Answer 1

在阅读了注释之后，让我展示使用bind views的两种情况的设置(您的域是dnssec，客户端是dnssec )。

考虑以下配置(我在生产中使用)

options {
        listen-on port 53 { any; };
        max-cache-size 128M;
        interface-interval 0;
        notify explicit;
        allow-transfer { none; };
        allow-update { none; };
        allow-recursion { none; };
        forwarders {
            2620:119:35::35;
            2620:119:53::53;
            208.67.222.222;
            208.67.220.220;
            2001:4860:4860::8888;
            2001:4860:4860::8844;
            8.8.8.8;
            8.8.4.4;
        };
        //dig -t txt -c chaos VERSION.BIND @<dns.server.com>
        version "Microsoft Windobe 2008 DNS Server. Et je t'emmerde (-_-)";
        auth-nxdomain no;    # love RFC1035
        dnssec-enable yes;
        dnssec-validation auto;
};

acl internal {
    127.0.0.0/8;
    ::1/128;
    10.0.0.0/8;
    fd9f::/64;
};

acl external {
    any;
};

view "internal" {
    match-clients {
        internal;
    };
    allow-recursion {
        any;
    };
};

view "external" {
    match-clients {
        any;
    };
    recursion no;
    zone "127-0-0-1.fr" {
        type master;
        file "/var/lib/bind/127-0-0-1.fr.db";
        key-directory "/var/lib/bind";
        auto-dnssec maintain;
        inline-signing yes;
    };
};

此BIND9服务器充当域127-0-0-1.fr的权威名称服务器和内部(私有)客户端的递归名称服务器。

让我们尝试使用dig @fd9f::10:0:0:2 www.isc.org将启用DNSSEC的域(完整链确定)解析为内部客户机。

; <<>> DiG 9.14.4 <<>> @fd9f::10:0:0:2 isc.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49658
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: d1c6f836121beafdedbc5fae5d5e281dc5c58851413f4fb2 (good)
;; QUESTION SECTION:
;isc.org.                       IN      A

;; ANSWER SECTION:
isc.org.                59      IN      A       149.20.1.66

;; Query time: 136 msec
;; SERVER: fd9f::10:0:0:2#53(fd9f::10:0:0:2)
;; WHEN: Thu Aug 22 07:29:01 CEST 2019
;; MSG SIZE  rcvd: 80

注意ad标志，它意味着经过验证的数据。与delv @fd9f::10:0:0:2 www.isc.org核对

;; fetch: isc.org/A
;; fetch: isc.org/DNSKEY
;; fetch: isc.org/DS
;; fetch: org/DNSKEY
;; fetch: org/DS
;; fetch: ./DNSKEY
; fully validated
isc.org.                59 IN A 149.20.1.66
isc.org.                59 IN RRSIG A 5 2 60 (
                                20190904145623 20190805140610 28347 isc.org.
                                ty+0um1WeOQvOIDMfA0w4spR4qNwm4Pj581KA9xXMFro
                                0+N0bKDAcDJ3O8EpdEHzjejXU0GqrJvIyml7fpvmbcN4
                                b2QWr/INjW8e+MzFz49oajGF0G1Oi6Qzp/XIljibsSig
                                FUTZsnp5yL77PF2eJEc4CDlfgJOCGsYnWTEaNuI= )
isc.org.                59 IN RRSIG A 13 2 60 (
                                20190904145623 20190805140610 27566 isc.org.
                                QiL6Al0ycqO/Fxl4OUR017ck/Y6xnRG4qt/pRvzG1H/y
                                +xyt9EU3pvNqbus5mQYF7ruH6BFyQg5w94bnnjivGg== )

现在，对不启用DNSSESC的域dig @fd9f::10:0:0:2 dnssec-failed.org进行相同的检查。

; <<>> DiG 9.14.4 <<>> @fd9f::10:0:0:2 dnssec-failed.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 21410
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 758deba64c4f30ba6ac402da5d5e28d3572fa9aa192352cd (good)
;; QUESTION SECTION:
;dnssec-failed.org.             IN      A

;; Query time: 4298 msec
;; SERVER: fd9f::10:0:0:2#53(fd9f::10:0:0:2)
;; WHEN: Thu Aug 22 07:32:03 CEST 2019
;; MSG SIZE  rcvd: 74

如您所见，SERVFAIL和bind日志显示的解析失败

bind             | 22-Aug-2019 04:17:09.845 client @0x55b0a804ea80 fd9f::1#49348 (www.dnssec-failed.org): view internal: query: www.dnssec-failed.org IN A +E(0)K (fd9f::10:0:0:2)
bind             | 22-Aug-2019 04:17:09.938 view internal: validating www.dnssec-failed.org/A: bad cache hit (dnssec-failed.org/DNSKEY)
bind             | 22-Aug-2019 04:17:09.938 broken trust chain resolving 'www.dnssec-failed.org/A/IN': 2001:4860:4860::8888#53
bind             | 22-Aug-2019 04:17:09.938 client @0x55b0a804ea80 fd9f::1#49348 (www.dnssec-failed.org): view internal: query failed (broken trust chain) for www.dnssec-failed.org/IN/A at query.c:6786

但是，如果我用dig @fd9f::10:0:0:2 dnssec-failed.org +cd强制执行决议，我就能够得到响应，但是没有do标志，响应就不会被签名。

现在让我们使用127-0-0-1.fr从外部检查delv @2001:4860:4860::8888 www.127-0-0-1.fr +rtrace +multiline域

;; fetch: www.127-0-0-1.fr/A
;; fetch: 127-0-0-1.fr/DNSKEY
;; fetch: 127-0-0-1.fr/DS
;; fetch: fr/DNSKEY
;; fetch: fr/DS
;; fetch: ./DNSKEY
; fully validated
www.127-0-0-1.fr.       3599 IN A 164.132.222.187
www.127-0-0-1.fr.       3599 IN RRSIG A 7 2 3600 (
                                20190914021052 20190815015938 64469 127-0-0-1.fr.
                                aaQN/x+ZEfV1Vgp78QGdCEByau22cmt61pQ+7c+VdiUh
                                gmOy0+sPHcJZT6aq6FKRLMc+I76R/ZrzAnCK7mr96vXb
                                SCyiIVYGMva9lsl95zi4DK5FxacekonBkwB/l/upBhxb
                                Iiw+l3AZ4J19I7nQgGCSxj7vWqtQD1sb8jue/fw= )

最后一次检查是用dig @2001:4860:4860::8888 www.127-0-0-1.fr

; <<>> DiG 9.14.4 <<>> @2001:4860:4860::8888 www.127-0-0-1.fr
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45032
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.127-0-0-1.fr.              IN      A

;; ANSWER SECTION:
www.127-0-0-1.fr.       3536    IN      A       164.132.222.187

;; AUTHORITY SECTION:
127-0-0-1.fr.           3536    IN      NS      brown-sugar.127-0-0-1.fr.
127-0-0-1.fr.           3536    IN      NS      black-pearl.127-0-0-1.fr.

;; Query time: 10 msec
;; SERVER: 2001:4860:4860::8888#53(2001:4860:4860::8888)
;; WHEN: Thu Aug 22 06:23:52 CEST 2019
;; MSG SIZE  rcvd: 113

显示ad标志，这意味着经过验证的数据。您可以使用基于web的工具(如dnssec-分析仪 )进行检查。