dnssec godaddy & validations

Godaddy offer dnssec within their premium dns servers. They also manage  DS records. Here's hyperfeed.net  dnssec enable via godaddy dns-servers.


I'm using the dnsviz debugger to verify the  key tags , and to ensure that we are secured from the root down to the subdomain of hyperfeed dot net.

( http://dnsviz.net/d/hyperfeed.net/dnssec/ )

Ahe above graphical representation shows the key-tags  and by hovering over the  Root/  gTLD / domain  levels we can validate we are indeeed secured and get greater details.


e.g

By using  dig we can  validate the key tags , which should match the above graphical representations.

e.g

 dig +multiline +dnssec hyperfeed.net @pdns03.domaincontrol.com dnskey


( output shorten )

Remember DNSSEC on validates the authenticity of the response if a dnssec query is submitted. It provides no encryption ( review my earlier blog on dnscurve )

So by querying a resource-record we can validate the response by the "ad " flags;

So dnssec can be enabled with ease and validated very simple.

Ken Felix

Freelance Network / Security Engineer

kfelix  ----a---t---socpuppets ---d---o---t---com

     ^      ^

=(  @   @ )=

          o

       /     \

HOWTO: fortimail redundant members

In this blog we will look at the creation of a  redundant member in a fortimail appliance.

1^st off the fortimail does not offer any type of  LACP or any link-aggregation it allows for  redundant link paths but only one of the link are used. To created a  redundant link you need to follow these simple steps and rules

1.     remove all allowaccess and ip_address off  the selected ports

2.     ensure the ports are not setup as  dhcp

3.     create a new interface ( virtual ) and select  redundant

4.     provide a simple name for this interface

5.     add the selected ports for the redundant members

IMAGE1

Creation of a redundant virtual interface

IMAGE2

Adding the ports

IMAGE3

Reviewing the creation

The benefits of a redundant interface; The ability to eliminate a single path failure”. You will need to cable the  2 interfaces to 2 unique switches or blades to eliminate a single failure. A stack switch  would be ideal imho.

Once you have the interface configured, you can assign an address and use it like any real interface.

note on redundant interface requirements

Ken Felix

Freelance Network / Security Engineer

kfelix  ----a---t---socpuppets ---d---o---t---com

     ^      ^

=(  @   @ )=

          o

       /     \

All tied up in a knot dns-server ( basic configurations )

The Knot dns server pkg, is a authoritive-only dns server , that's  used by many ISP and TLDs for high performance operations.

It safe from ever becoming a open dns resolver, and based on various benchmarks, it's slighty better than the common bind9  server  which is  avilable thru isc.org

Here's how we install it at socpuppets.


1st: download the knot-server at the source website

wget https://www.knot-dns.cz/pages/download.html

2nd: your system will need a gcc compiler,  gawk,  lex, bison and the ssl libs; so  you should update your systems if not done already

e.g

apt-get install byacc flex gawk bison liburcu-dev libssl-dev

3rd: Run the configure & select the options that you require

configure --enable-microseconds-logs

 

4th: Now you can  start the compiling process

make ; make install




5th: if all compiles well, you should be presented with a knot server daemon

Configuration is quite simple and straight forward but for the first timer, you should copy the samples from the sample directory into your /etc/knot directory or whatever directory that you plan to opearte out of.

Now for the 1st timer, you should build the minimal  configuration to check the server operation;

system { storage "/etc/knot";
}
interfaces { my_interface { address 127.0.0.1@53; } second_int { address x.x.x.x@53; }
}
log { syslog { any notice, warning, error; }
}

zones { socpuppets.com { file "socpuppets.com"; } }

And then load the  server to check for any errors  configuration or zone database







Later you can  add avance configuration for remote control, logging and dnssec.




btw: The server will not answer any  client queries for recursion lookup.










So you are safe from abuse and will never become part of a DNS refelection atatck or  flood campaign

Ken Felix

Freelance Network / Security Engineer

kfelix  ----a---t---socpuppets ---d---o---t---com

     ^      ^

=(  @   @ )=

          o

       /     \