Dnssec

ReN

ReN

Verified User
Joined
Jul 2, 2005
Messages
172
Greetings guys , just curious if the DA team has anything in planning to implement DNSSEC into the DA system

ReN
 
DNSSEC has been officially implemented in some top level domains (see https://itar.iana.org/anchors/) and it will probably be mandatory or at least strongly suggested one day, therefore I suggest DA to implement it right away.
If you need specs, this is the place: http://www.dnssec.net/

It's fairly easy to implement and manage, many control panels already have it and it's an essential component for an "easy to use, easy to hack" panel like DA.
 
jlasman said:
In what way is DirectAdmin easy to hack?
Click to expand...
Many have been able to modify the way DA works by scripting it, creating custom configs for CustomBuild and using the very versatile settings accordingly to their needs.

I love to customize my systems and I've never been stopped by any DA function... until today, the day I would like to easily enable DNSSEC :)

By easily I mean without creating a script that tries to parse the Bind config and zones outputted by DA, by creating a separated set including DNSSEC configurations, and keys, and zone records, and by running a separated Bind distribution. Because I can do that, but that's a workaround and I never needed a workaround before.
 
Thanks for the clarification; I misread your hack as crack because so many people misuse the word that way.

Jeff
 
I understand. Even my title, "ethical hacker", is not really correct :( for that reason I prefer "security auditor".

Anyway, back in topic, I have to contact John soon for other issues and I'll address him this one too.
 
I wonder when this problem will take developers from DirectAdmin support :) :)
 
Last edited:
Since the change is backwards compatible you should be forced to do nothing, but since some old and small routers do not support large DNS replies over UDP check that none of your servers are behind one of them and uses its nameserver. There are ways to check for that all over the web.
 
And make sure that your firewalls are open for multi-directional tcp/ip traffic on port 53.

Jeff
 
So what does this mean:

Code: 
dig txt test.rs.ripe.net +short
rst.x477.rs.ripe.net.
rst.x481.x477.rs.ripe.net.
rst.x486.x481.x477.rs.ripe.net.
"64.233.168.94 DNS reply size limit is at least 486 bytes"
"64.233.168.94 lacks EDNS, defaults to 512"
"64.233.168.94 summary bs=512,rs=486,edns=0,do=0"
 
floyd

from what i understand you would need to make the following additions to your named.conf :

in the options section add;
edns-udp-size: 4096

restart your named service and run the test again and see what the results look like.

Basically the result should not come back saying "lacks edns" and in the summary bs should be more than rs by a margin of not more than 300

Update:
Also this requires a bind version 9.3.2 and higher
 
Last edited:
You must log in or register to reply here.
Back
Top