{"id":685,"date":"2019-02-02T23:01:55","date_gmt":"2019-02-02T16:01:55","guid":{"rendered":"http:\/\/notes.opikdesign.com\/?p=685"},"modified":"2019-02-22T01:49:03","modified_gmt":"2019-02-21T18:49:03","slug":"config-dnssec-di-authoritative-bind-9-11-x","status":"publish","type":"post","link":"https:\/\/notes.opikdesign.com\/index.php\/2019\/02\/02\/sys-admin\/config-dnssec-di-authoritative-bind-9-11-x\/","title":{"rendered":"Config DNSSEC di Authoritative Bind 9.11.x"},"content":{"rendered":"\n

DNSSEC singkatan dari Domain Name System Security Extensions, adalah rangkaian dari IETF (Internet Engineering Task Force) yang berfungsi mengamankan beberapa jenis informasi yang diberikan oleh DNS. DNSSEC akan menambahkan tanda tangan digital (Signed SSL) yang berguna untuk menjaga keaslian data DNS yang di respon oleh client, sehingga client dapat mengetahui bahwa data itu berubah atau tidak. DNS Server menggunakan protocol UDP port 53 sedangkan DNSSEC berbeda, yaitu menggunakan protocl TCP port 53. Perbedaan lainnya dapat dilihat dengan menggunakan DIG<\/strong>, contoh:<\/p>\n\n\n\n\n\n\n\n

Contoh tanpa DNSSEC<\/p>\n\n\n\n

[root@ns1 ~]# dig @192.168.56.18 opikdesign.com. A +dnssec +multiline

; <<>> DiG 9.11.2 <<>> opikdesign.com. A +dnssec +multiline
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63502
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 

;; QUESTION SECTION:
;opikdesign.com.        IN A

;; ANSWER SECTION:
opikdesign.com.        3600 IN A 192.168.56.10
 
;; AUTHORITY SECTION:
opikdesign.com.        3600 IN NS ns1.opikdesign.com.
opikdesign.com.        3600 IN NS ns2.opikdesign.com.
 
;; ADDITIONAL SECTION:
ns2.opikdesign.com. 3600 IN A 192.168.56.18
ns1.opikdesign.com. 3600 IN A 172.16.57.11

;; Query time: 34 msec
;; SERVER: 192.168.56.18#53(192.168.56.18)
;; WHEN: Tue Jan 29 14:31:51 WIB 2019
;; MSG SIZE  rcvd: 209

<\/pre>\n\n\n\n
Contoh dengan DNSSEC, akan muncul hash tambahan<\/p>\n\n\n\n
[root@ns1 ~]# dig @172.16.57.11 opikdesign.com. A +dnssec +multiline

; <<>> DiG 9.11.2 <<>> opikdesign.com. A +dnssec +multiline
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63502
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 

;; QUESTION SECTION:
;opikdesign.com.        IN A

;; ANSWER SECTION:
opikdesign.com.        3600 IN A 192.168.56.10
opikdesign.com.        3600 IN RRSIG A 8 3 3600 (
             20190227192735 20190128192735 738 opikdesign.com.
             Lhp1OTFpKHfHKx7XoxOmqyONv2Ee7SgGVOA1F5jApnTy
             NPZyBt+nHO0bTA0ha7x6N1F2pyo+\/HXRYNRfYcjY8XZm
             kQw2R4e15fYIi42GIgxGDBsPCX2BkE08cHGb0L+hOZLw
             Wd4YFvISRNaHE0HW4\/+ObmHJ+m19ws6aiVxTpB4= )
 
;; AUTHORITY SECTION:
opikdesign.com.        3600 IN NS ns1.opikdesign.com.
opikdesign.com.        3600 IN NS ns2.opikdesign.com.
opikdesign.com.        3600 IN RRSIG NS 8 3 3600 (
                 20190227192735 20190128192735 738 opikdesign.com.
                 K3YOGQIdCYjWjU+FW1WnuULxfhfV2t1r3qS8SxxVTKpy
                 +aPgvOfu9QBLQHvYkqYadccFBjuop\/fH9aUrpiLqmJxk
                 \/UCLwp2hKJugwme6mIx4tlAZaWLVlTTBtFTL7A\/4WqgZ
                 RHABSRCrMu8p9TsyQmGH413+qq8YGNqW1QppF\/o= )

;; ADDITIONAL SECTION:
ns2.opikdesign.com. 3600 IN A 192.168.56.18
ns1.opikdesign.com. 3600 IN A 172.16.57.11
ns1.opikdesign.com. 3600 IN RRSIG A 8 4 3600 (
                 20190227192711 20190128192711 39813 opikdesign.com.
                 G\/J+u7AUyM6OWwvsGXAJCKWsA+682ZPc77YpfKNtfjeD
                 \/wjQzZ0O6AQ9ItM7\/6D6zopjFgRjGjfvWfmhRMrCIorx
                 nLUHh3K8W+KBp7t+k3VCf60d27ugFp4bSAFKoErrrzVH
                 45oz+deH7sh8knnBtzOtnbFr8MgBv6xz9wfa7qY= )
ns2.opikdesign.com. 3600 IN RRSIG A 8 4 3600 (
                 20190227192711 20190128192711 39813 opikdesign.com.
                 Pnpnrig+kzyF1yDiVslIxLrlha2RWAYLJYe3rpBJ3bdT
                 Wc6Ikcbiv\/AThazy9VKtJD+ibo2rg++9datV+\/1DT3mH
                 h3tAN4RDpI6emPO4XctWnoccHX5JVa39\/US6zw3NIRuR
                 kaPTFvcJudG7SsxYFGCrWnMk4wKmmohYCizRzyo= )

;; Query time: 34 msec
;; SERVER: 172.16.57.11#53(172.16.57.11)
;; WHEN: Tue Jan 29 14:31:51 WIB 2019
;; MSG SIZE  rcvd: 209<\/pre>\n\n\n\n
Sedangkan yang dibutuhkan untuk mengaktifkan DNSSEC perlu SSL di BIND, cara pengecekan sebagai berikut, perhatikan yang di Bold<\/strong><\/p>\n\n\n\n
[root@ns1 ~]# named -V
BIND 9.11.2 
running on Linux x86_64 3.10.0-862.11.6.el7.x86_64 #1 SMP Tue Aug 14 21:49:04 UTC 2018
built by make with '--prefix=\/usr' '--sysconfdir=\/etc' '--localstatedir=\/var' '--mandir=\/usr\/share\/man' '--enable-threads' '--with-libtool' '--disable-static' '--with-openssl=\/usr'<\/strong> '--with-randomdev=\/dev\/urandom'
compiled by GCC 4.8.5 20150623 (Red Hat 4.8.5-28)
compiled with OpenSSL version: OpenSSL 1.0.2k  26 Jan 2017
linked to OpenSSL version: OpenSSL 1.0.2k-fips  26 Jan 2017<\/strong>
compiled with zlib version: 1.2.7
linked to zlib version: 1.2.7
threads support is enabled<\/pre>\n\n\n\n
Langsung saja, di sini tidak di bahas perbedaan cara kerjanya dan sebagainya, untuk configuration basic -nya membuat DNS Server bisa ke Install Bind 9.11.1 di CentOS 7 dengan Master-Slave.<\/a> <\/strong>Disini penulis menganggap installasi server dan zone domain sudah berjalan semestinya, dilanjut bagaimana proses mengaktifkan DNSSEC dan merubah zone yang ter-signed.<\/p>\n\n\n\n
Aktifkan DNSSEC di BIND<\/strong><\/p>\n\n\n\n
Open file named.conf.options<\/em>, isi edit sebagai berikut, setelah edit restart named<\/p>\n\n\n\n
options {
           .....
           dnssec-enable yes;
           dnssec-validation yes;
           dnssec-lookaside auto;
}
<\/pre>\n\n\n\n
sebelum restart named, dengan menggunakan tools nmap  <\/strong>ke localhost, bind menggunakan UDP\/53 namun setelah restart named akan berganti ke TCP\/53<\/p>\n\n\n\n
Membuat ZSK Key dan KSK Key<\/strong><\/p>\n\n\n\n
Sebelum membuat key, masuk ke folder zones terlebih dahulu barulah membuat key -nya.<\/p>\n\n\n\n
[root@ns1]# cd \/var\/named\/chroot\/etc\/namedb\/master<\/pre>\n\n\n\n
Membuat ZSK Key dengan menggunakan algorithma RSA SHA256 1024bit…<\/p>\n\n\n\n
[root@ns1 master]# dnssec-keygen -a RSASHA256 -b 1024 -n ZONE opikdesign.com
Generating key pair\u2026\u2026\u2026\u2026\u2026\u2026\u2026.++++++  ..++++++
Kopikdesign.com. +008+06963

[root@ns1 master]# 
<\/pre>\n\n\n\n
Membuat KSK Key dengan menggunakan algorithma RSA SHA256 2046bit…<\/p>\n\n\n\n
[root@ns1 master]# dnssec-keygen -a RSASHA256 -b 2046 -n ZONE -f KSK opikdesign.com
Generating key pair\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026
 \u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026.......+
 ++  \u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026+++
 Kopikdesign.com. +008+24610

[root@ns1 master]# 
<\/pre>\n\n\n\n
Menggabungkan ZSK file key dengan KSK Key dan membuat file ZONES baru<\/strong><\/p>\n\n\n\n
Menggabungkan menjadi satu file ikuti perintah berikut…<\/p>\n\n\n\n
[root@ns1 master]# cat Kopikdesign.com.+008+*.key >> opikdesign.com.zone

<\/pre>\n\n\n\n
Membuat file ZONES<\/p>\n\n\n\n
[root@ns1 master]# dnssec-signzone -t -g -o opikdesign.com opikdesign.com.zone Kopikdesign.com.+008+*.private
Verifying the zone using the following algorithms: RSASHA256.
Zone signing complete:
Algoritm:  RSASHA256:  KSKs:   1 active,   0 stand-by,   0 revoked
                       ZSKs:   1 active,   0 stand-by,   0 revoked
opikdesign.com.zone.signed
Signatures generated:                                          10
Signatures retained:                                            0
Signatures dropped:                                             0
Signatures successfully verified:                               0
Signatures unsuccessfully verified:                             0
Signing time in seconds:                                    0.021
Signatures per second:                                    435.825
Runtime in seconds:                                         0.035

[root@ns1 master]# 

<\/pre>\n\n\n\n
kemudian pada file \/var\/named\/chroot\/etc\/named.zones<\/strong><\/em> di edit dari file zone -nya domain sebagai berikut…<\/p>\n\n\n\n
zone \"opikdesign.com\" IN {
         ...
         file \"master\/opikdesign.com.zone\";
         ...
};<\/pre>\n\n\n\n
ganti file zone -nya…<\/p>\n\n\n\n
zone \"opikdesign.com\" IN {
         ...
         file \"master\/opikdesign.com.zone.signed\";
         ...
};<\/pre>\n\n\n\n
terakhir restart bind…<\/p>\n\n\n\n
[root@ns1 master]# systemctl restart named<\/pre>\n","protected":false},"excerpt":{"rendered":"
DNSSEC singkatan dari Domain Name System Security Extensions, adalah rangkaian dari IETF (Internet Engineering Task Force) yang berfungsi mengamankan beberapa jenis informasi yang diberikan oleh DNS. DNSSEC akan menambahkan tanda tangan digital (Signed SSL) yang berguna untuk menjaga keaslian data DNS yang di respon oleh client, sehingga client dapat mengetahui bahwa data itu berubah atau … <\/p>\n
Continue reading “Config DNSSEC di Authoritative Bind 9.11.x”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[13,4],"tags":[23,21,22,57],"class_list":["post-685","post","type-post","status-publish","format-standard","hentry","category-dns-server","category-sys-admin","tag-bind","tag-cenos-7","tag-dns-server","tag-dnssec"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/notes.opikdesign.com\/index.php\/wp-json\/wp\/v2\/posts\/685","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/notes.opikdesign.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/notes.opikdesign.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/notes.opikdesign.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/notes.opikdesign.com\/index.php\/wp-json\/wp\/v2\/comments?post=685"}],"version-history":[{"count":18,"href":"https:\/\/notes.opikdesign.com\/index.php\/wp-json\/wp\/v2\/posts\/685\/revisions"}],"predecessor-version":[{"id":713,"href":"https:\/\/notes.opikdesign.com\/index.php\/wp-json\/wp\/v2\/posts\/685\/revisions\/713"}],"wp:attachment":[{"href":"https:\/\/notes.opikdesign.com\/index.php\/wp-json\/wp\/v2\/media?parent=685"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/notes.opikdesign.com\/index.php\/wp-json\/wp\/v2\/categories?post=685"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/notes.opikdesign.com\/index.php\/wp-json\/wp\/v2\/tags?post=685"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}