156 lines
5.6 KiB
Plaintext
156 lines
5.6 KiB
Plaintext
|
|
INSTALL_SEC
|
|
|
|
Bind with Secure DNS (TIS/DNSSEC)
|
|
Version 1.3.0 Beta
|
|
September 1996
|
|
|
|
This version has been compiled and tested on SUNOS 4.1.3,
|
|
FreeBSD-2.1.5-REL and Linux 2.0.11.
|
|
There may be still be portability problems.
|
|
If you have access to other hardware platforms please let us know if
|
|
there are any problems porting and send us patches, to include in
|
|
future releases.
|
|
|
|
This version of secure Bind uses RSAREF-2.0 library from RSA,
|
|
First you should get/read the RSAREF FAQ
|
|
http://www.consensus.com/rsaref-faq.html
|
|
Then you can copy RSAREF from
|
|
ftp://ftp.rsa.com/rsaref/README
|
|
|
|
You need to read this README file carefully for further instructions.
|
|
|
|
Installation: (this version is based on 4.9.4-REL-P1).
|
|
|
|
1. The tar ball will create a directory sec_bind in the current directory
|
|
untar the archive
|
|
The content of the sec_bind directory has the same directory
|
|
structure as bind distribution with the addition of the directories
|
|
dnssec_lib/ and signer/, some named directories have been
|
|
deleted from the distribution.
|
|
|
|
dnssec_lib/ contains the library files for signature generation
|
|
signer/ contains tools for signing bind boot files and
|
|
generating keys.
|
|
|
|
In addition, there is a new file, "res/res_sign.c", which
|
|
contains library routines that are required in the resolver
|
|
for displaying new RR types.
|
|
|
|
You need to tailor sec_bind/Makefile to your system as you do
|
|
with bind distributions.
|
|
|
|
The sec_bind distribution expects to find RSAREF in the
|
|
rsaref/ subdirectory. If you install RSAREF in a different
|
|
place you can place a pointer to the RSAREF installation
|
|
directory in place of sec_bind/rsaref.
|
|
|
|
sec_bind/Makefile expects to find the RSAREF library file
|
|
at sec_bind/rsaref/lib/rsaref.a. The RSAREF distribution
|
|
does not contain that directory. If you are installing RSAREF
|
|
for the first time create that directory copy the correct
|
|
Makefile from the appropriate rsaref/install/ subdirectory.
|
|
Sec_bind will compile RSAREF for you.
|
|
|
|
We recommend that you use an ANSI C compliant compiler to
|
|
compile this distribution.
|
|
|
|
2. Follow Bind installation guidelines on your system
|
|
|
|
Set your normal configuration in conf/options.h with the
|
|
following exceptions/additions:
|
|
ROUND_ROBIN must be OFF (for right now)
|
|
DNS_SECURITY must be ON
|
|
RSAREF must be ON if you have a copy of RSAREF.
|
|
This version of sec_bind does not work well without RSAREF.
|
|
|
|
3. make
|
|
If you are going to use make install everything will work right
|
|
out of the box. If you are going to run programs out of the
|
|
sec_bind directory you need to set the DESTEXEC variables
|
|
accordingly.
|
|
|
|
4. Once everything compiles you can run the simple test that is include in
|
|
the distribution.
|
|
|
|
First you need to edit the file signer/simple_test/test.boot to
|
|
set directory directive to the full path of the directory this
|
|
file is in.
|
|
|
|
Now the signer program can be run to sign the simple_test data.
|
|
The signed zone will be written to /tmp
|
|
% cd sec_bind/signer
|
|
% make test
|
|
The passwords for the keys in the distribution are:
|
|
Key: Password:
|
|
foo.bar foo.bar
|
|
mobile.foo.bar mobile
|
|
fix.foo.bar fix.foo.bar
|
|
sub.foo.bar sub.foo.bar
|
|
some.bar some.bar
|
|
|
|
Notice the differences between simple_test/test.boot and
|
|
/tmp/test.boot. The pubkey directive are required for correct
|
|
behavior of new named.
|
|
|
|
To check the if named can read the new zone files and verify
|
|
the signatures run following commands
|
|
% cd ../named
|
|
% make test
|
|
|
|
Exit/error code 66 indicates that program completed normally
|
|
in "load-only" mode (new -l flag).
|
|
|
|
If you want to load up named run same command as make test does
|
|
without -l flag. (the -d 3 flag is to make sure the process
|
|
does not do a fork).
|
|
% ./named -p 12345 -b /tmp/test.boot -d 3
|
|
|
|
% cd ../tools
|
|
% ./dig @localhost snore.foo.bar. -p 12345
|
|
This should return an A record + SIG(A) record
|
|
% ./dig @localhost no_such_name.foo.bar. -p 12345
|
|
This should return a NXT record +SIG(NXT) for *.foo.bar.
|
|
|
|
You can also test against our nameserver for zone sd-bogus.tis.com
|
|
the host is uranus.hq.tis.com(192.94.214.95)
|
|
% ./dig @uranus.hq.tis.com sd-bogus.tis.com. soa
|
|
will return the SOA and SIG(SOA) + KEY
|
|
% ./dig @uranus.hq.tis.com sd-bogus.tis.com. mb
|
|
will return NXT for sd-bogus.tis.com
|
|
% ./dig @uranus.hq.tis.com foo.sd-bogus.tis.com. ns
|
|
will NS +KEY for foo.sd-bog.tis.com.
|
|
|
|
5. Converting your setup to secure DNS zones.
|
|
need to create a key for your zone.
|
|
If you have a copy of the last release of sec_bind the key file
|
|
format has changed and you need to regenerate all your keys, Sorry.
|
|
The new format for private key files is portable between
|
|
different architectures and operating systems, the encryption
|
|
of the key file is compatible with the des program.
|
|
|
|
To generate key use sec_bind/signer/key_gen. To generate zone key
|
|
for name you.bar, with 512 bit modulus and exponent of 3,
|
|
execute following command
|
|
|
|
% cd signer
|
|
% ./key_gen -z -g 512 you.bar
|
|
|
|
key_gen will ask for an encryption password for the private
|
|
key file, if you do not want to encrypt the key hit <Return>.
|
|
The program will output resource record suitable for zone file.
|
|
key_gen creates two files you.bar.priv and foo.bar.public.
|
|
|
|
If you want, at any time, to display the public key for foo.bar
|
|
run key_gen without the -g flag or cat file foo.bar.public.
|
|
key_gen without any flags will print out the usage information.
|
|
key_gen has extensive error checking on flags.
|
|
|
|
To modify the flags field for an existing key run key_gen with
|
|
the new flags but without the -g flag.
|
|
|
|
Note: The key above is suitable for signing records but not for
|
|
encrypting data.
|
|
|
|
6. Send problems, fixes and suggestions to dns-security@tis.com.
|