DuckCorp » DuckCorp Infrastructure

glibc 2.11 is now in testing.

Since 00:00 UTC on 1 July 2010 all root servers are ready. Nevertheless, Gandi does not support DNSSEC at all (list of DNSSEC-enabled .org registrars).

Interim trust anchors (IANA ITAR) are only a stopgap, and will probably not help push DNSSEC as an important matter. Then, signing zones is possible but not really useful nowadays. Nevertheless, we should learn and prepare our zones, to be able to provide the service for our users.

All 3 servers have been configured for root zone validation (but without DLV or ITAR, which are stopgaps and not a real solution).

The following documentation (and script) was helful: https://calomel.org/dns_bind.html

Testing opendnssec. Log:

apt-get install opendnssec opendnssec-auditor libsofthsm softhsm

adduser opendnssec softhsm
setfacl -m o::- /var/lib/softhsm/slot0.db
setfacl -m u:opendnssec:rw /var/lib/softhsm/slot0.db

softhsm --init-token --slot 0 --label "OpenDNSSEC" 
-> (PIN) 1234
ods-ksmutil setup
/etc/init.d/opendnssec-enforcer restart

setfacl -m g:opendnssec:rx /etc/bind
setfacl -m g:opendnssec:rx /etc/bind/master
setfacl -m d:g:opendnssec:rx /etc/bind/master
setfacl -m g:opendnssec:r /etc/bind/master/*.zone
mkdir /etc/bind/master/signed
setfacl -m g:opendnssec:rwx /etc/bind/master/signed
setfacl -m d:g:opendnssec:rwx /etc/bind/master/signed
setfacl -m g:opendnssec:r /etc/bind/rndc.key

ods-ksmutil zone add --zone plop.net --input /etc/bind/master/plop.net.zone --output /etc/bind/master/signed/plop.net.zon
ods-ksmutil key list -v

• http://dnssec-debugger.verisignlabs.com/
• http://dnsviz.net/

I'm testing key publishing with 'plop.net' fake zone.

According to http://www.gandibar.net/post/2010/08/25/What-you-can-expect-this-fall Gandi is far from having DNSSEC available. Seems many other providers are late to support DNSSEC. The DLV system seems clean, so we may try providing signed zones using it, even if it a shamy situation.

I don't want to handle the migration from DLV to our parent zone for hq.duckcorp.org, so i'm choosing milkypond.org which is not as critical as the other zones. The signed zone is now propagating and the KSK is in the publish state.

The publish state was reached. I used the following command to switch it to active, but i'm not sure it was needed (need to wait another enforcer run perhaps):

ods-ksmutil key ds-seen --keytag <key-tag> --no-retire

I then registered the domain and added the cookie, and now the DLV is published. We can check this with:

host -t dlv <domain>.dlv.isc.org

DNSViz is nice to check the secured path.

I need to have a look at published-only KSK keys (like org. is doing).

duckcorp.org is on the way. I had to switch to partial mode for the OpenDNSSEC Auditor because of a bug: http://trac.opendnssec.org/ticket/189

OpenDNSSEC installed and working on Elwing. hq.duckcorp.org is now on the way.

I found in hs.duckcorp.org the DNS-SD SRV records where rejected by OpenDNSSEC, and that was because the spaces in the RR name was not properly encoded ('\ ' -> '\032').

Note: wait for the published KSK key to become active before pushing a dssub KSK KEY to dsready, or it will end-up with 2 active KSK keys.

HQ IPv6 zones are now signed. Waiting for publishing time before adding them in the DLV Registry.

hq.duckcorp.org is now secured using a DS in the duckcorp.org zone.

Note: no need to publish SHA1 DS, which is now considered unsecure, only one DS line is sufficient.

All remaining HQ zones are now in the DLV Registry.

All secondary KSK keys have been moved to dspublish. Waiting to get them to dsready.