DNSSEC Mastery: Securing the Domain Name System with BIND by Michael W Lucas

Author:Michael W Lucas
Language: eng
Format: epub
Tags: security, linux, bind, bsd, dns, dns security extensions, dnssec, domain name system security extensions
Publisher: Tilted Windmill Press

Creating Keys

Up until now we've talked about keys, looked at keys, and generally poked at them. Now let's actually generate some KSKs and ZSKs with dnssec-keygen. You must specify an algorithm by either name or number, the number of bits, and the zone name. If you're creating a key signing key, you must add the flag for that.

By default, dnssec-keygen creates RSA/SHA-1 keys with 1024-bit ZSKs and 2048-bit KSKs. For all other algorithms, you must specify the number of bits. Get into the habit of including the algorithm and bits on the command line or in your scripts. That way, changing defaults over the years won't surprise you.

To create a key signing key, use the –f ksk option. Specify the algorithm with –a, and the number of bits with –b. You can use the algorithm name instead of the number, removing all punctuation from the name (i.e., RSASHA1 or RSASHA256). For RSA/SHA1-NSEC3-SHA1 keys, add the -3 flag instead of the algorithm name. I prefer using the number rather than typing the whole name. Give the name of the zone as the final argument.

$ dnssec-keygen –f KSK –a 8 –b 2048 zonename

For example, to create a KSK for the zone michaelwlucas.com, I would run:

$ dnssec-keygen -f KSK -a 8 -b 2048 michaelwlucas.com

Generating key pair.................................+++ ............................+++

Kmichaelwlucas.com.+008+48082

This generates two files in the current directory, Kmichaelwlucas.com.+008+48082.key and Kmichaelwlucas.com.+008+48082.private.

Generate your ZSK similarly, but reduce the number of bits and remove the KSK flag.

# dnssec-keygen –a 8 –b 1024 zonename

This generates a 1024-bit RSA/SHA-256 ZSK.

Remember that the user running named must have read access to these files, so make that user the owner of these files. Do not make the key files world-readable.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.