DNS DNS 2002/12/19 Internet Week 2002/DNS DAY 2

Size: px

Start display at page:

Download "DNS DNS 2002/12/19 Internet Week 2002/DNS DAY 2"

こうじたもん
8 years ago
Views:

1 DNS Internet Week 2002/DNS DAY ( ) (JPRS) <[email protected]>

2 DNS DNS 2002/12/19 Internet Week 2002/DNS DAY 2

3 DNS SOA SOA TTL $TTL NS MX CNAME 2002/12/19 Internet Week 2002/DNS DAY 3

4 SOA SOA $ORIGIN example.jp. $TTL IN SOA ns1.example.jp. hostmaster.example.jp. ( ; serial ; refresh ; retry ; expire 1200 ; minimum ) 2002/12/19 Internet Week 2002/DNS DAY 4

5 SOA Serial ( : ) (BIND ) BIND YYYYMMDDnn (RFC1912) djbdns ( ) Refresh ( : ) (Serial) 20 2 ( ) BIND Notify djbdns 1 (RFC1912) 2002/12/19 Internet Week 2002/DNS DAY 5

6 SOA Retry ( : ) Refresh (Retry) Refresh Refresh 1 Expire ( : ) 2 4 (RFC1912) Expire Refresh 2002/12/19 Internet Week 2002/DNS DAY 6

7 SOA Minimum ( : ) TTL (RFC1035) (RFC2308) ( ) 2002/12/19 Internet Week 2002/DNS DAY 7

8 SOA TTL $TTL SOA TTL(SOA Minimum) (RFC1035,RFC1918) RR TTL (RFC2308) TTL TTL $TTL BIND 2002/12/19 Internet Week 2002/DNS DAY 8

9 SOA TTL $TTL SOA TTL 1 5 (RFC1912) 1 (=86400) SOA TTL (RFC2308) : SOA TTL 1 ( ) ( ) BIND djbdns TTL 2002/12/19 Internet Week 2002/DNS DAY 9

10 TTL BIND SOA TTL 10 (RFC (=1200)) $TTL 1 3 (RFC (=86400)) djbdns ( ) SOA TTL: 2560 (42 40 ) TTL: 86400(1 ) NS NS A TTL: (3 ) 2002/12/19 Internet Week 2002/DNS DAY 10

11 (SOA ) Minimum TTL (RFC2308 ) TTL SOA TTL: 10 TTL($TTL): /12/19 Internet Week 2002/DNS DAY 11

12 RR NS, MX, CNAME 2002/12/19 Internet Week 2002/DNS DAY 12

13 NS (DNS 1 ) $ORIGIN IN NS ns1.example.co.jp. IN NS secondary.provider.ne.jp. 2( DNS ) $ORIGIN IN NS hosting1.provider.ne.jp. IN NS hosting2.provider.ne.jp. 2002/12/19 Internet Week 2002/DNS DAY 13

14 (provider.ne.jp) 100% DNS provider.ne.jp secondary.provider.ne.jp example.co.jp 1 ( ) ns1.provider.co.jp 2 ( ) 2002/12/19 Internet Week 2002/DNS DAY 14

15 MX $ORIGIN IN MX 10 mx1.provider.ne.jp. 2002/12/19 Internet Week 2002/DNS DAY 15

16 (provider.ne.jp) 100% DNS provider.ne.jp mx1.provider.ne.jp example.co.jp 2002/12/19 Internet Week 2002/DNS DAY 16

17 CNAME $ORIGIN example.co.jp. www IN CNAME www1.provider.ne.jp. 2002/12/19 Internet Week 2002/DNS DAY 17

18 ( CNAME DNS (DNS ) 2002/12/19 Internet Week 2002/DNS DAY 18

19 ( ) NS( MX) NS A ( NS ) /12/19 Internet Week 2002/DNS DAY 19

20 (NS) IP NS (A) NS (NS): $ORIGIN IN NS ns1.example.co.jp. IN NS secondary.example.co.jp. secondary IN A xxx.xxx.xxx.xxx ;DNS IP secondary.example.co.jp secondary.provider.ne.jp ( ) secondary A example.co.jp 2002/12/19 Internet Week 2002/DNS DAY 20

21 (MX) NS MX (A) MX (MX) $ORIGIN IN MX 10 mx1.example.co.jp. mx1 IN A xxx.xxx.xxx.xxx ; IP mx1.example.co.jp mx1.provider.ne.jp mx1 A example.co.jp 2002/12/19 Internet Week 2002/DNS DAY 21

22 (CNAME) CNAME A CNAME CNAME DNS CNAME ( ) 2002/12/19 Internet Week 2002/DNS DAY 22

23 ( ) NS, MX ( ) ( ) DNS ( ) CNAME 2002/12/19 Internet Week 2002/DNS DAY 23

24 DNS in-addr.arpa NS NS DNS DNS query ID, MS DNS 2002/12/19 Internet Week 2002/DNS DAY 24

25 in-addr.arpa RFC2317(BCP) CNAME ( ) ( IP 2002/12/19 Internet Week 2002/DNS DAY 25

26 : CNAME (BIND ) : /29 ( in-addr.arpa) $ORIGIN IN SOA IN NS subnet136 IN NS ns1.example.co.jp. 136 IN CNAME 136.subnet in-addr.arpa. 137 IN CNAME 137.subnet in-addr.arpa. 138 IN CNAME 138.subnet in-addr.arpa. 139 IN CNAME 139.subnet in-addr.arpa. 140 IN CNAME 140.subnet in-addr.arpa. 141 IN CNAME 141.subnet in-addr.arpa. 142 IN CNAME 142.subnet in-addr.arpa. 143 IN CNAME 143.subnet in-addr.arpa. 2002/12/19 Internet Week 2002/DNS DAY 26

27 : CNAME (BIND ) $ORIGIN IN SOA IN NS ns1.example.co.jp. 136 IN PTR cust-net.example.co.jp. 137 IN PTR router.example.co.jp. 138 IN PTR host1.example.co.jp. 139 IN PTR host2.example.co.jp. 140 IN PTR host3.example.co.jp. 141 IN PTR host4.example.co.jp. 142 IN PTR host5.example.co.jp. 143 IN PTR broadcast.example.co.jp. 2002/12/19 Internet Week 2002/DNS DAY 27

28 : CNAME (BIND ) : /29 ( in-addr.arpa) $ORIGIN in-addr.arpa. 136 IN NS ns1.example.co.jp. 137 IN NS ns1.example.co.jp. 138 IN NS ns1.example.co.jp. 139 IN NS ns1.example.co.jp. 140 IN NS ns1.example.co.jp. 141 IN NS ns1.example.co.jp. 142 IN NS ns1.example.co.jp. 143 IN NS ns1.example.co.jp. 2002/12/19 Internet Week 2002/DNS DAY 28

29 : CNAME (BIND ) $ORIGIN IN SOA IN NS ns1.example.co.jp. IN PTR cust-net.example.co.jp. $ORIGIN IN SOA IN NS ns1.example.co.jp. IN PTR router.example.co.jp. named.conf 2002/12/19 Internet Week 2002/DNS DAY 29

30 in-addr.arpa CNAME BIND BIND CNAME RFC 1998 BIND ( Best Current Practice ) BIND CNAME IP named.conf 1 CNAME named.conf 2002/12/19 Internet Week 2002/DNS DAY 30

31 BIND CNAME ( PTR CNAME 2002/12/19 Internet Week 2002/DNS DAY 31

32 CNAME ( ) ( ) 2002/12/19 Internet Week 2002/DNS DAY 32

33 NS NS : TTL (jp) $ORIGIN jp. $TTL example IN NS ns1.example.jp. (example.jp) $ORIGIN example.jp. $TTL IN NS ns1.example.jp. DNS example.jp NS (TTL ) 86400? ? 2002/12/19 Internet Week 2002/DNS DAY 33

34 BIND NS BIND NS query MX A query NS BIND NS query djbdns ( ) NS query MX A query NS (BIND9.2.1 ) 2002/12/19 Internet Week 2002/DNS DAY 34

35 NS RFC1034 The RRs that describe cuts around the bottom of the zone are NS RRs that name the servers for the subzones. Since the cuts are between nodes, these RRs are NOT part of the authoritative data of the zone, and should be exactly the same as the corresponding RRs in the top node of the subzone. BIND , djbdns BIND 8.x ( ) 2002/12/19 Internet Week 2002/DNS DAY 35

36 DNS CERT/CC Knowledge Base (KB): Vulnerability Note VU#457875: Various DNS service implementations generate multiple simultaneous queries for the same resource record BIND DNS Vulnerable Vulnerable 2002/12/19 Internet Week 2002/DNS DAY 36

37 BIND (4, 8, 9 ) DNS UDP brute-force attack BIND DNS query ID ( ) ISC DNSSEC 2002/12/19 Internet Week 2002/DNS DAY 37

38 query ( BIND ) DNS query ID(16 ) : 2 16 : 2 32 djbdns DNS query ID /12/19 Internet Week 2002/DNS DAY 38

39 MS DNS Microsoft DNS cache poisoning 1997 BIND DNS /12/19 Internet Week 2002/DNS DAY 39

40 MS DNS ( ) IP DNS ( ) (MS Web Page) Microsoft Windows domain name resolver service accepts responses from non-queried DNS servers by default DNS Query ID ( ) URL 2Esecurity&t=%3Cmid%2D25%2Dsecurity%40jwntug%2Eor%2Ejp %3E 2002/12/19 Internet Week 2002/DNS DAY 40

41 : ( ) BIND4 BIND8 ISC RFC DNS RFC RFC(RFC2317 ) RFC1034: Domain names - concepts and facilities. RFC1035: Domain names - implementation and specification. RFC1912: Common DNS Operational and Configuration Errors. RFC2181: Clarifications to the DNS Specification. RFC2308: Negative Caching of DNS Queries (DNS NCACHE). 2002/12/19 Internet Week 2002/DNS DAY 41

DNS (BIND, djbdns) JPNIC・JPCERT/CC Security Seminar 2005

DNS (BIND, djbdns) JPNIC・JPCERT/CC Security Seminar 2005 DNS 2005 10 6 JPNIC JPCERT/CC Security Seminar 2005 DNS Pharming BIND djbdns 2 DNS DNS (Domain Name System)? IP www.example.jp IP 172.16.37.65 http://www.example.jp/ - http://172.16.37.65/