Information Document 17-E课件.pptVIP

86400 NXT . NS SOA MX TXT SIG KEY NXT 86400 SIG NXT 1 2 86400 20010727200820 ( 20010627200820 42000 . jhBUcRSzoMCwzc1FVgOKrl+mSgv7f/Ri8/mb Q1dtGz/+0KKXa0u4s+T1SygG8wHs3Y/IOPq+ qn5YSbMtAmSajQ== ) . 86400 IN A 3 86400 SIG A 1 3 86400 20010727200820 ( 20010627200820 42000 . ZpD/YrrFQzeFJWENIe4U1Z2xpVmRxzBabYKw xe61bqrLsg2EuOv7CRdNwxWvEbZPN4Rf64GG oaGV97him2C10Q== ) 86400 NXT . A SIG NXT 86400 SIG NXT 1 3 86400 20010727200820 ( 20010627200820 42000 . dub7z+Gq4ZnJqRB1ucJfsgIsMv8WepkzrvyY +kn3NfTOGBC51tJgcyW8HMxQz/D9ig39KO8G wl6Wc7upvReUMA== ) . 86400 IN A 86400 SIG A 1 3 86400 20010727200820 ( 20010627200820 42000 . Ks14BB6UVciyfxgJ4R5eXFZrRUmnuPhTgfjQ 0r3FCyvdOr6Uu5iLSTbzgulY+qZXaXF9tCTK +65y5VxUk3WtBQ== ) 86400 NXT . A SIG NXT 86400 SIG NXT 1 3 86400 20010727200820 ( 20010627200820 42000 . ro1TRC7idXJw/MpLBLY/sXBlNAoLcSjKKR7t mD91i7hhW9OF4R8Ql01QU+MYrjui9kOw2isU /8BY63MCfbqlnw== ) Windows 2000 Windows 2000 uses Dynamic DNS updates Active Directory Does not use TSIG Uses a proprietary mechanism, GSS-TSIG Based on “mangled” Kerberos tickets GSS-TSIG proposed as IETF standard No second implementation (yet) Summary Transaction Signatures (TSIG) have been explained in this section: How to use them for authentication clients, name servers, dynamic update requests Using them in BIND Access Control Lists Timestamps mean clocks should be synchronised Windows 2000 issues Secure DNS (DNSSEC) This section explains DNSSEC: Secure DNS Rationale for DNSSEC What problems DNSSEC solves What problems it does not solve What problems DNSSEC creates KEY, SIG and NXT records BIND9s DNSSEC utilities Signing a zone Why Secure DNS? The DNS is not secure!!! Servers could be lying Cache poisoning attacks Servers could be spoofed Answers could be tampered with UDP makes these attacks simple This is what Secure DNS is designed to solve What DNSSEC Does Not Do Prevent/thwart denial-of-servi