untitled

Size: px

Start display at page:

Download "untitled"

まさとしそや
4 years ago
Views:

1 Practical DNS Operation: Internet Week

2 DNS / DNS DAY DNS / 3 DNS DAY DNS DAY root jp DNS RFC 4 2

3 agenda DNS DNS amplification attack glue /24 Lame Delegation NOTIFY DNS Layer3 DNS CNAME TTL (,) $GENERATE serial, comin' back! rndc.key 1 2 named -u(setuid),-t(chroot) stub? BIND 9 5 * * SPF Sender-ID TXT RR / DNSSEC TSIG Dynamic Update ENUM Active Directory politics djbdns ANS/CNS PowerDNS BIND 6 3

4 7 DNS 8 4

5 DNS.(root) com jp kr example.co.jp thomas edward henry gordon james percy 9 DNS ( ) DNS authority authority ( ) authority authority 10 5

6 DNS ( ) 11 DNS ( ) ssh stub getaddrinfo() DNS API query /etc/resolv.conf (TCP/IP) 12 6

7 2 worldwide root /etc/resolv.conf (TCP/IP) recursive 13 2 ( ) worldwide authority primary secondary NS RR Internet Registry authoritative 14 7

8 2 ( ) 2 /recursive /authoritative (DNS ) BIND named 1 djbdns(dnscache,tinydns) Nominum(CNS,ANS) NSD 15 primary/secondary/master/slave primary v.s. secondary primary secondary master 16 8

9 primary/secondary/master/slave master v.s. slave / master slave secondary 2 secondary master slave 17 primary/secondary primary/secondary :Microsoft Windows XP Copyright Microsoft Corporation 18 9

10 fallback /etc/resolv.conf (TCP/IP) 2 BIND stub res_inin() 1 query 19 authority localhost link local address( /16) private address =NXDOMAIN SOA NS private address A pc1.example1.co.jp B printer.example9.co.jp : 20 10

11 21 (RFC1035) label: 63 name: 255 name thomas.example.co.jp label 22 11

12 ( ) TCP fall back RR A 1 v.s. SOA NS MX authority section additional section NS RDATA AAAA RFC Message compression EDNS0(RFC2671) 512octet IP UDP UDP EDNS octet BIND9 4096octet (options{edns-udp-size}) 23 kohi@thomas[1]% dig example.co.jp ANY ;; Truncated, retrying in TCP mode. ; <<>> DiG example.co.jp ANY ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL:

13 ( ) ;; QUESTION SECTION: ;example.co.jp. IN ANY ;; ANSWER SECTION: : example.co.jp IN SOA ns.example.co.jp. hostmaster.example.co.jp example.co.jp IN NS very-very-long-name.a example.co.jp. 25 ( ) example.co.jp IN TXT "my name is jugemu jugemu gokou-no surikire, kaijarisuigyo-no fuuraimatsu, kuuraimatsu, unraimatsu, yaburakouji-no burakouji, paipo paipo paipo-no shuuringan, shuuringan-no guurindai, guurindai-no pompokopi-no pompokona-no choukyuumei-no chosuke." ;; ADDITIONAL SECTION: very-very-long-name.a example.co.jp IN A

14 ( ) very-very-long-name.a example.co.jp IN AAAA 2001:db8::1 : : ;; Query time: 0 msec ;; SERVER: #53( ) ;; WHEN: Fri Aug 26 17:58: ;; MSG SIZE rcvd: ( ) RFC1035 label - ( ) RFC com.com 0123.co.jp RFC2181 8bit clean 28 14

15 ( ) _ BIND4.9.x slave(secondary) BIND8 9.3 (RFC1035) zone{check_names ;}; warn,fail,ignore BIND (RFC2181) / internetweek.jp InternetWeek.JP 29 DNS amplification attack 30 15

16 DNS amplification attack TCP 3way handshake (spoofing) UDP TCP DNS source query? IP DNS amplification attack 31 DNS amplification attack( ) EDNS0 UDP 512octet(+UDP/IP ) EDNS

17 DNS amplification attack( ) botnet RR :TXT TTL 33 DNS amplification attack( ) botnet Query Layer3 RR :TXT TTL 34 17

18 DNS amplification attack( ) Layer 3 ISP urpf transit AS transit AS urpf loose mode IP 35 DNS amplification attack( ) urpf unicast Reverse Path Forwarding Cisco Juniper strict mode loose mode strict mode 36 18

19 DNS amplification attack( ) / /19 37 DNS amplification attack( ) urpf(strict mode) dest egress : /8 GE0/0 : /12 GE0/0 : /19 FE1/0 : / /12 : GE0/0 FE1/ / /19 GE0/

20 DNS amplification attack( ) urpf(loose mode) dest egress : /8 GE0/0 : /12 GE0/0 : /19 FE1/0 : / /12 : GE0/0 FE1/ / /24( ) 39 DNS amplification attack( ) query allow-query allow-recursion referral root referral BIND 9 named built-in root file /dev/null ; 40 20

21 glue 41 authority ( ) 42 21

22 ( ) DNS 43 ( ) ns.example.co.jp: $ORIGIN example.co.jp. engineering NS ns.engineering ns.engineering A sales NS ns pc1.hr A pc2.hr A

23 ( ) ns.engineering.example.co.jp: $ORIGIN IN SOA... ( : ) NS ns ns A fs1 A lab1 A AAAA 2001:db8:: ( ) authority engineering.example.co.jp. RR sales.example.co.jp. RR hr.example.co.jp

24 glue $ORIGIN example.co.jp. engineering NS ns.engineering lab1.engineering.example.co.jp A ns.engineering.example.co.jp query IP? 47 glue( ) $ORIGIN example.co.jp. engineering NS ns.engineering ; answer section ns.engineering A ; glue additional section query 48 24

25 glue( ) glue( ) example.co.jp engineering.example.co.jp 49 glue( ) $ORIGIN example.co.jp. engineering NS ns.engineering ns.engineering A engineering.example.co.jp authority ns.engineering.example.co.jp glue A RR non-authoritative 50 25

26 glue( ) engineering.example.co.jp NS A NS A glue example.co.jp authoritative 51 glue( ) $ORIGIN example.co.jp. engineering NS ns.engineering NS ns.example1.ad.jp. ns.engineering.example.co.jp glue ns.example1.ad.jp IP glue glue 52 26

27 glue( ) BIND NS RDATA glue glue Internet Week 2004 DNS DAY 53 glue( ) glue 2 $ORIGIN IN NS ns1.example1.ad.jp. NS ns2.example1.ad.jp. $ORIGIN IN NS ns1.jp.example1.net. NS ns2.jp.example1.net

28 fetch-glue(bind8) named.conf options{fetch-glue yes_or_no;}; additional section? / BIND8 yes no BIND9 no named.conf 55 /

29 / /25: A /28: B /29: C /29: D /27: E /26: F Class C 57 /24 ( ) /8 -> 172.in-addr.arpa /16 -> in-addr.arpa /24 -> in-addr.arpa /27 ->??? in-addr.arpa.? /

30 RFC2317 RFC2317 Classless IN-ADDR.ARPA delegation (Best Current Practice) 0/ in-addr.arpa. (A : /25) 128/ in-addr.arpa. (B : /28) : 192/ in-addr.arpa. (F : /26) 59 RFC2317( ) in-addr.arpa in-addr.arpa. ->1.0/ in-addr.arpa in-addr.arpa. ->2.0/ in-addr.arpa. : in-addr.arpa. -> / in-addr.arpa. : CNAME 60 30

31 /24 16 in-addr.arpa / in-addr.arpa /25 128/

32 RFC2317( ) ISP / in-addr.arpa in-addr.arpa. 157.d-group in-addr.arpa. : ISP 63 /24 ( ) in-addr.arpa.? ISP PTR GUI ISP PTR CGI DNS 64 32

33 Lame Delegation 65 Lame Delegation? authority lame delegation APNIC authority lame delegation non-authoritative answer DNSQC Task Force by WIDE,JPRS,JPNIC 66 33

34 Lame Delegation ( ) 1 lame delegation 53/tcp, 53/udp unreach DNS query SOA query Authoritative Answer bit JPNIC lame NS Open Policy Meeting 67 Lame Delegation?( ) authority authority example.co.jp. IN NS ns.example.co.jp. NS ns.example1.ad.jp. ns.example.co.jp example.co.jp authority ns.example1.ad.jp example.co.jp authority 68 34

35 ? root jp ns.example.co.jp root referral SERVFAIL ns.example1.ad.jp www 69? authority authority secondary expire authority authority / xsp secondary ISP ISP etc,etc 70 35

36 ( )? example.co.jp. IN NS ns.example.co.jp. NS ns.example1.ad.jp. example1.ad.jp lame delegation example1.ad.jp ns.example1.ad.jp 71 NOTIFY 72 36

37 NOTIFY slave refresh master serial serial = NOTIFY master refresh refresh 73 NOTIFY master refresh serial? serial? serial? AXFR slave refresh! master serial? slave! 74 37

38 NOTIFY RFC1996 RR primary secondary secondary refresh secondary NOTIFY NS RR SOA mname =primary) secondary stealth slave named.conf also-notify 75 NOTIFY primary sedondary sedondary NOTIFY RR response response AXFR NOTIFY (retry) NOTIFY response AXFR 76 38

39 NOTIFY( ) NOTIFY secondary NSD(2.x ) NSD(2.x ) refresh ( ) 77 DNS 78 39

40 transport UDP TCP fallback TCP query 53 query 79 query stub resolver 53 UDP (TCP) UDP (TCP)

41 NOTIFY NOTIFY master 53 slave UDP (TCP ) master 53 slave TCP 81 TCP query TCP fallback Layer4 Layer7 named.conf allow-transfer{} TCP fallback TCP query ack (SYN_SENT) 82 41

42 ( ) query BIND4 query 53 53<->53 deny 53 permit response retry :warm 1434/udp ->1434/udp deny ->53/udp->1434/udp=DNS 83 Layer3 DNS 84 42

43 DNS traceroute IP? DoS : 85 ( ) 1 traceroute in-band management loopback DNS / so-6/0/0 ->so

44 ( ) 1 foundry2.otemachi.example.ad.jp 87 ( ) 2 sjc3-nrt3-stm4-2.sjc3.example.net (PR?) 88 44

45 ( ) 3 so m.br2.pao2.example.net (PR?) 89 ( ) example.ne.jp example.ne.jp 6 pool example.ne.jp example.ne.jp ISP 90 45

46 ISP-A ISP-B ISP-A /30 ISP-A: ISP-B: ISP-A ISP-B / ( ) ( ) ISP-A ISP-B / $ORIGIN in-addr.arpa. : 13 PTR ge1-2.router.jp.isp-a.net. 14 PTR isp-b.peer.isp-a.net

47 ( ) ISP-A ISP-B / $ORIGIN in-addr.arpa. : 13 PTR ge1-2.router.jp.isp-a.net. 14 NS ns.isp-b.ad.jp. 4octet(/32) $ORIGIN IN SOA ( : ) NS ns.isp-b.ad.jp. PTR ge3-0.router.isp-b.ad.jp. 4octet(/32)

48 $ORIGIN example.co.jp. directive thomas 12H IN A AAAA 2001:db8::1 owner TTL class type RDATA zone data Resource Record(RR) 95 owner owner TTL $TTL( SOA minimum) class RFC1035 class BIND8,BIND9 1 named.conf zone 96 48

49 CNAME 97 CNAME? owner alias canonical RDATA owner RDATA alias www IN CNAME server237 alias canonical name 98 49

50 CNAME owner RR www IN CNAME server237 MX 10 po 99 ( ) IN SOA ns hostmaster ( H 15M 4W 15M) NS ns CNAME po ; MX

51 ( ) 2 CNAME BIND4 BIND8 multiple-cnames yes BIND9 www IN CNAME backend1 CNAME backend2 101 ( )

52 ( ) NS MX RDATA CNAME alias RFC974 RFC2181 must not be an IN NS ns ns CNAME cabernet-sauvegnon 103 CNAME CNAME alias1 IN CNAME alias2 alias2 CNAME alias3 alias3 CNAME alias

53 ( ) RFC xx BIND8 8 BIND9 16 djbdns 4 ( ) 1 RFC 2 RFC BIND9 16 djbdns CNAME $ORIGIN example.co.jp. www IN CNAME rental800.example1.ad.jp. example.co.jp ( ) example1.ad.jp (DNS : =authoritative ) WWW

54 CNAME ( ) $ORIGIN example.co.jp. www IN CNAME rental800.example1.ad.jp. $ORIGIN example1.ad.jp. rental800 IN A rental800 IN A CNAME ( ) Internet Week 2002 DNS DAY DNS

55 TTL 109 TTL TTL=Time To Live RR

56 negative cache query RR RR query cache RR cache RFC negative cache( ) NXDOMAIN type RR NODATA NXRRSET BIND8.2 $TTL SOA minimum

57 negative cache( ) minimum RR query negative cache BIND minimum max-ncache-ttl 113 negative cache negative cache TTL RR TTL minimum $TTL

58 TTL? RR thomas 1d IN A $TTL RR TTL $TTL IN SOA thomas.example.co.jp. ( ) : 115 ( ) $TTL RFC2308 BIND 8.2 negative cache $TTL RR named BIND9.0.x 9.1.x

59 ( ) SOA minimum BIND8.2 TTL BIND8.2 negative cache ( )RR 1 RR BIND8.2 RR $TTL minimum 9.0.x 9.1.x 117? $TTL RFC1912(Common DNS Errors,1996) 1 5 MX A PTR RR 1 2 DNS 100 ( ) RR 900=15 0 ( ) ? 1996 TTL?

60 ?( ) TTL -> query ->query ID DNS DAY 119?( ) minimum RFC2308(DNS NCACHE) 1200=20 BIND8,BIND9 max-ncache-ttl 10800=

61 named rndc flush(bind9.2.0 ) rndc flushname name(bind9.3.0 ) rndcflush negative cache rndc flushname negative cache BIND (BIND ) SOA $TTL w(week) d(day) h(hour) m(min) ARM Setting TTLs All of these TTLs default to units of seconds, though units can be explicitly specified, for example, 1h30m. (?) ARM: BIND9 Administrator Reference Manual

62 (,) 123 IN SOA ns hostmaster ( h 15m 4w 15m ) SOA (,)

63 (,) ( ) ( ) SOA Parentheses are used to group data that crosses a line boundry. In effect, line terminations are not recognized within parentheses. RFC MASTER FILES; 5.1. Format 0.f.e.d.c.b.a ( IN PTR gordon.example.co.jp.) BIND9 BIND8 125 $GENERATE (BIND )

64 $GENERATE $GENERATE dhcp$ A $ dhcp193 A dhcp194 A : dhcp254 A $GENERATE( ) $GENERATE /2 dhcp${-192,3,d} A $ dhcp001 A dhcp003 A : dhcp061 A

65 $GENERATE( ) $GENERATE /2 step dhcp${-192,3,d} 193,195,197,... {o,d,x,x} : 1= dhcp001 A serial, comin back!

66 serial, comin back! serial 32bit 0 4,294,967,295=(2^32)-1 n 2,147,483,647(=(2^31)-1) n n 2,147,483,647 n 4,294,967, = serial, comin back!( ) Sep 4 14:43:18 thomas named[35341]: general: error: dns_rdata_fromtext: localhost:3: near ' ': out of range Sep 4 14:43:18 thomas named[35341]: general: error: zone localhost/in: loading master file localhost: out of range reload ;_; secondary secondary

67 serial, comin back!( ) n= (2^31)-1= >2^32 n'=n-2^32= < n' n' < n' (2^32)-1 n

68 rndc.key 135 named BIND8: ndc UNIX TCP BIND9: rndc TCP TSIG BIND8 TCP : TCP, :INET

69 rndc rndc named rndc.conf named.conf rndc 137 rndc( ) named.conf controls{} rndc.conf rndc.key rndc-confgen -a named rndc rndc.key

70 rndc.key named named.conf controls{} ::1 953/tcp /etc/rndc.key named.conf controls{} key{} inet inet /etc/rndc.key named.conf controls{} [!]rndc rndc rndc.conf /etc/rndc.key 139 rndc rndc named rndc-confgen -a rndc.key permission 400 rndc.conf owner,group,permission wheel su rndc named.conf key key include

71 1 2 named named PC Free OS address in use query (r)ndc named.conf named.pid named.stats

72 1 2 named( ) INET IP query 53 ->IP ifconifg em0 alias(freebsd) ifconfig eth0:0 (Linux) named.conf named -c /etc/named-contents.conf named.pid named.stats named.conf options{} chroot() 143 localhost private address link local address ( inaddr.arpa) allow-transfer DNS DoS allow-query localhost DNS amplification attack allow-recursion referral

73 recursion no; allow-transfer root DNS amplification attack BIND9 built-in file "/dev/null"; BIND8 fetch-glue no; IP

74 (BIND8) options { directory "/etc/namedb"; allow-query { acl; }; allow-transfer { localhost; }; fetch-glue no; pid-file "/var/run/named-cache.pid"; listen-on { ; }; }; 147 (BIND8: ) controls { unix "/var/run/ndc-cache" perm 0600 owner 53 group 53; }; zone "." IN { type hint; file "named.root"; }; zone "localhost" IN { type master; file "localhost"; }; # localhost private address

75 (BIND8) options { directory "/etc/namedb"; allow-transfer { acl; }; fetch-glue no; recursion no; pid-file "/var/run/namedcontents.pid"; listen-on { ; }; }; 149 (BIND8: ) controls { unix "/var/run/ndc-contents" perm 0600 owner 53 group 53; }; zone "example.co.jp" IN { type master; file "example.co.jp"; }; #

76 ndc ns# ndc -c /var/run/ndc-cache status named REL Fri Oct 1 12:22:57 JST 2004 kohi@ns:/.amd_mnt/alphonse/u/share/usr/local/s rc/bind/bind-8.4.5/src/bin/named config (/etc/named-cache.conf) last loaded at age: Wed Sep 21 11:41: number of zones allocated: 64 debug level: 0 xfers running: 0 xfers deferred: 0 soa queries in progress: 0 query logging is OFF server is initialising itself 151 (BIND9) options { directory "/etc/namedb"; allow-query { acl; }; allow-transfer { localhost; }; pid-file "/var/run/named-cache.pid"; listen-on { ; }; };

77 (BIND9: ) controls { inet allow { localhost; }; }; zone "localhost" IN { type master; file "localhost"; }; # localhost private address 153 (BIND9) options { directory "/etc/namedb"; allow-transfer { localhost; }; recursion no; pid-file "/var/run/namedcontents.pid"; listen-on { ; }; };

78 (BIND9: ) controls { inet allow { localhost; }; }; zone "." IN { type hint; file /dev/null; }; zone "example.co.jp" IN { type master; file "example.co.jp"; }; # 155 rndc ns# rndc -s status number of zones: 1 debug level: 0 xfers running: 0 xfers deferred: 0 soa queries in progress: 0 query logging is OFF recursive clients: 0/1000 tcp clients: 0/100 server is up and running

79 Internet Week 2003 DNS DAY DNS named amplification attack options { allow-query { ACL; }; }; zone "example.co.jp" IN { : allow-query { any; }; : };

80 -u(setuid),-t(chroot) 159 named -u setuid() named root root setuid() root named named.pid rndc.key

81 named -t chroot() named root root root named 161 -u -t named -u named -t named ->-u -t

82 named -u bind -t /sandbox (BIND8) chroot() syslog open() named.pid chown() named-xfer named.pid chown() setuid() reload,reconfig syslog open() 163 named -u bind -t /sandbox (BIND8: ) named.pid uid reload reconfig /sandbox/var/run/log(syslog ) syslogd -l /sandbox/var/run/log(freebsd) ndc /sandbox/var/run/ndc slave named-xfer named /sandbox/usr/libexec/named-xfer /sandbox/usr/lib/libc.so, named-xfer static link

83 named -u bind -t /sandbox (BIND9) syslog open() chroot() setuid() named.pid reload,reconfig named.pid rndc.key syslog open() 165 named -u bind -t /sandbox (BIND9: ) chroot() openlog() reload reconfig openlog() syslogd -l /sandbox/var/run/log(freebsd) reload reconfig rndc.key bind

84 named -t /sandbox /proc 1 CPU Fedora Core 2+SMP kernel+htt CPU /sandbox/proc procfs mount /etc/localtime timezone UTC log FreeBSD cp /etc/localtime /sandbox/etc 167 stub?

85 stub? BIND8 libbind /usr/local/bind/lib BIND9 libbind configure OS libc fix? BIND9!!! 169 BIND

86 BIND9 BIND9 "not yet implemented" CHANGES ARM 171 BIND9 ( ) listen-on-v6 any specific (9.2.0 ) ISC_FACILITY(9.3.0 ) syslog check-names(9.3.0 ) RFC2181 ->RFC1035 ixfr-from-difference(9.3.0 ) dynamic update IXFR( ) etc,etc

87 173 / / RFC DNS DAY tips know how

e164.arpa DNSSEC Version JPRS JPRS e164.arpa DNSSEC DNSSEC DNS DNSSEC (DNSSEC ) DNSSEC DNSSEC DNS ( ) % # (root)

e164.arpa DNSSEC Version JPRS JPRS e164.arpa DNSSEC DNSSEC DNS DNSSEC (DNSSEC ) DNSSEC DNSSEC DNS ( ) % # (root) 1.2.0.0.1.8.e164.arpa DNSSEC Version 1.0 2006 3 7 JPRS JPRS 1.2.0.0.1.8.e164.arpa DNSSEC DNSSEC DNS DNSSEC (DNSSEC ) DNSSEC DNSSEC DNS ( ) % # (root) BIND DNS 1. DNSSEC DNSSEC DNS DNS DNS - 1 - DNS DNS