Subject: Re: DNSSEC

From: "Glen Barney (AMS)" <[email-masked]>
Date: Tue, 31 Aug 2010 07:36:17 -0700

Community - 

The DNS zone files have been re-signed, and we will look into alternatives to
the original DNSSEC tools that were in use (which seem to be broken.)

And just a reminder that, while posting complaints to this list might feel
more therapeutic, the secretariat has an address set up for trouble reports,
which is [email-masked] .  Sending complaints to that address will
generally get much faster results.

Thank you!

Glen
Glen Barney
IT Director
AMS (IETF Secretariat)

---

From: todd glassey <[email-masked]>
Date: Tue, 31 Aug 2010 07:45:35 -0700

> generally get much faster results.

Glen your real issue is why DNSSEC was released in this condition and
the damage to the world in the form of wasted effort this causes.
Something that for what its worth provides yet another black-eye for the
IETF (and the parties making GSO and the IETF their career).

Todd Glassey
> 
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf
> 
> 
> 
> 
> No virus found in this incoming message.
> Checked by AVG - www.avg.com 
> Version: 9.0.851 / Virus Database: 271.1.1/3103 - Release Date: 08/30/10 11:34:00
> 

-- 
//-----------------------------------------------------------------

This message may contain confidential and/or privileged information.
If you are not the addressee or authorized to receive this for the
addressee, you must not use, copy, disclose or take any action based
on this message or any information herein. If you have received this
message in error, please advise the sender immediately by reply e-mail
and delete this message.

Thank you for your cooperation.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 31 Aug 2010 11:02:57 -0400

Whether or not the IAB zone is signed is of negligible consequence.

But the fact that the IAB zone signatures had expired is a highly
significant data point: DNSSEC administration is not quite as easy as
some of the glib claims of its more enthusiastic supporters would lead
one to believe.

-- 
Website: http://hallambaker.com/

---

From: Donald Eastlake <[email-masked]>
Date: Tue, 31 Aug 2010 11:45:19 -0400

Hi Phil,

> some of the glib claims of its more enthusiastic supporters would lead

Sounds like a straw man to me. Can you provide a pointer to some of
these glib claims?

For years I have been hearing, correctly I believe, that lack of
logistical and administrative tools and support for DNSSEC was the
main problem slowing deployment. Recent developments like RFC 5011
(Automated Updates of DNS Security (DNSSEC) Trust Anchors) have
improved things a lot. And, as an original architect of DNSSEC, I
admit that the early proposal set was deficient in this area.

Donald

---

From: Mark Andrews <[email-masked]>
Date: Wed, 01 Sep 2010 11:05:47 +1000

In message <[email-masked]>, Phil
> some of the glib claims of its more enthusiastic supporters would lead

It's more a matter of choosing the right tools.  I've got signed
zones that haven't been hand signed in 3 years using a 2 month
signature validity interval.  The nameserver just re-signs the
records as they fall due.  That's several thousand automatic updates
of the zones in that period.  Yes, I've changed the non DNSSEC
content of the zones in that time.

This isn't a protocol issue.  It's a tools issue and DNSSEC tools
from all vendors are improving.

It's also extremely easy to construct tools that can warn you to
re-sign if you are doing it by hand.  You could replace awk with
perl and have a cross platform tool.  Such tools can easily be
added to network management platforms as they are just small
scripts.  If you don't have a network managment platform use
cron.

e.g.

% dig axfr dv.isc.org @bsdi.dv.isc.org | awk '$4 == "RRSIG" && $9 < WARN { print }' WARN=`date -u -v +7d +%Y%m%d%H%M%S`
%

% dig axfr dv.isc.org @bsdi.dv.isc.org | awk '$4 == "RRSIG" && $9 < WARN { print }' WARN=`date -u -v +1m +%Y%m%d%H%M%S`
bind9-test-8.dv.isc.org. 86400	IN	RRSIG	NSEC 5 4 86400 20100929190221 20100731184853 14436 dv.isc.org. 2jHCGeJqH23dO0RV48Uqqp2hXIl1wp3kIslqmdz686uaCNz3WZZUhKzX EH+8iKc6QQWMZhFzhJoqruiTO6RyIA==
BRNEE8E63.dv.isc.org.	1800	IN	RRSIG	A 5 4 1800 20100929190221 20100731184853 14436 dv.isc.org. ZhD6uAbGQYDWJ6rob9iyvRNWZ7Tod1as4WEtPV8C+mLF8aJbakwp/76/ f7r7jz/fQOtIMQ/NjXBRT7O4507gIA==
BRNEE8E63.dv.isc.org.	1800	IN	RRSIG	TXT 5 4 1800 20100929190221 20100731184853 14436 dv.isc.org. Xl3nk8lf2exwGGy2iI2BxVjXO3emvI+8GRmkj+vi7n8rddmP6oJRqPGZ wmNoZVxMN9XMTghly6w6Cmj8aNAILQ==
BRNEE8E63.dv.isc.org.	86400	IN	RRSIG	NSEC 5 4 86400 20100929190221 20100731184853 14436 dv.isc.org. JUR1M8GmlFFYF73v6oh+bdwYuKK0YBMe7b4mDsMBs1bdBqHB52KUZ8eS KNCRD3GTp8VzwxB1TGmuIq+dGr57lQ==
% 

With a minor change it will print out just the zone.

% dig axfr dv.isc.org @bsdi.dv.isc.org | awk '$4 == "RRSIG" && $9 < WARN { print "WARNING:", $12, "needs re-signing" ; exit }' WARN=`date -u -v +1m +%Y%m%d%H%M%S`
WARNING: dv.isc.org. needs re-signing
% 

Wrap it is a while loop and you can do all your zones.  The getline
is so we don't generate error messages in the nameserver logs by
causing the axfr to be aborted.

#!/bin/sh -f
WARN=`date -u -v +7d +%Y%m%d%H%M%S`
while read zone server
do
	dig axfr "$zone" "@$server" | \
	awk '$4 == "RRSIG" && $9 < WARN 
	    { print "WARNING:", $12, "needs re-signing."; while (getline) ; }' \
		WARN=$WARN
done

Mark

> > The DNS zone files have been re-signed, and we will look into alternative=
> s to
> > more therapeutic, the secretariat has an address set up for trouble repor=
> ts,
> > which is [email-masked] . =A0Sending complaints to that address will
> -- =
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]