1 technical-dns-workshop-day1
0 likes711 views
The document outlines the ICANN/NTRA/NSRC/ATI DNS Operations and DNSSEC workshop held in Cairo, Egypt, from July 27-30, 2015. It covers the fundamental concepts of DNS, including its structure, security aspects, operations of root servers, domain registration, and resource records, along with practical labs for attendees. The workshop aims to enhance understanding and technical skills related to DNS and its associated technologies.
1 technical-dns-workshop-day1
- 1. DNS Operations and DNSSEC Workshop ICANN / NTRA / NSRC / ATI | Cairo, Egypt | 27-30 July l 2015
- 2. | 2 Intros - Trainers • Champika Wijayatunga – Regional SSR Engagement Manager – APAC, ICANN • Adel Riyad – Senior Systems Engineer – NTRA • Riahi Chamseddine – DNS Administrator - ATI
- 3. | 3 Acknowledgements • Rick Lamb – DNSSEC Senior Program Manager – ICANN • Phil Regnauld – NSRC • NSRC, APNIC, NTRA
- 4. | 4 Agenda • Day 1 – DNS Concepts – Root Servers, Authoritative Servers, Recursive Servers – Unix Administration Recap – Labs • Day 2 – DNS Server / Domain configurations – DNS and IPv6 – Reverse DNS Configurations – Labs • Day 3 – DNS Debugging Tools and Utilities – DNS Security – Labs • Day 4 – TSIG – DNSSEC and Key management – Labs
- 5. Brief Overview of DNS 5
- 6. | 6 What is the Domain Name System? A distributed database primarily used to obtain the IP address, a number, e.g., 192.168.23.1 or fe80::226:bbff:fe11:5b32 that is associated with a user-friendly name (www.example.com) Why do we need a DNS? It’s hard to remember lots of four decimal numbers and it’s impossibly hard to remember hexadecimal ones 6
- 7. | 7 The World’s Network – the Domain Name System + Internet Protocol numbers are unique addresses that allow computers to find one another + The Domain Name System matches IP numbers with a name + DNS is the underpinning of unified Internet + DNS keeps Internet secure, stable and interoperable + ICANN was formed in 1998 to coordinate DNS
- 8. | 8 History 1983 DNS was designed/invented by Paul Mockapetris (RFC882 & 883) 1984 Berkeley Internet Name Domain (BIND) Server developed Original Seven Generic TLDs (.com, .edu, .gov, .int, .mil, .net, and .org) 1985 First country codes assigned .us, .uk, and .il 1986 .au, .de, .fi, .fr, .jp, .kr, .nl and .se 1987 RFC1034 (Considered the first full DNS Specification) …….. Country Code TLDs continue to be added…. 2000 Seven new TLDs added (.aero, .coop, .museum, .biz, .info, .name, and .pro) 2012 New round of applications for gTLDs opened by ICANN
- 9. | 9 Names in country-code TLDsNames in generic Top Level Domains DNS Structure • A domain is a node in the Internet name space – A domain includes all its descendants • Domains have names – Top-level domain (TLD) names are generic or country-specific – TLD registries administer domains in the top-level – TLD registries delegate labels beneath their top level delegation . org icann ncfta www ssac gov irs com ... ftc google msn AF ... ZW google co
- 10. | 10 Who are the Root Server operators? • Not "one group", 12 distinct operators • Operational and technical cooperation • Participate in RSSAC as advisory body to ICANN • High level of trust among operators – Show up at many technical meetings, including IETF, ICANN, RIR meetings, NOG meetings, APRICOT etc.
- 11. | 11 How Secure are the Root Servers? • Physically protected • Tested operational procedures • Experienced, professional, trusted staff • Defense against major operational threat – i.e. DDoS. – Anycast • Setting up identical copies of existing servers • Same IP address • Exactly the same data. • Standard Internet routing will bring the queries to the nearest server • Provides better service to more users.
- 13. | 13 Root Server Operation @ICANN + ICANN is the L-Root Operator + L-Root nodes keep Internet traffic local and resolve queries faster + Make it easier to isolate attacks + Reduce congestion on international bandwidth + Redundancy and load balancing with multiple instances
- 15. | 15 DNS Servers • DNS is a distributed database • Types of DNS servers – DNS Authoritative • Primary (Master) • Secondary (Slaves) – DNS Resolver • Recursive • Cache • Stub resolver 15
- 16. | 16 Operational elements of the DNS • Authoritative Name Servers host zone data – The set of “DNS data” that the registrant publishes • Recursive Name Resolvers (“resolvers”) – Systems that find answers to queries for DNS data • Caching resolvers – Recursive resolvers that not only find answers but also store answers locally for “TTL” period of time • Client or “stub” resolvers – Software in applications, mobile apps or operating systems that query the DNS and process responses
- 17. | 17 Domain name “directory assistance” How does a resolver find the IP address of ICANN.ORG? • Resolvers find answers by asking questions iteratively dns1.icann.org m.root-servers.net Ask root name servers for IPv6 address of ICANN.ORG Ask a0.org.afilias-nst.info for IPv6 address of ICANN.ORG Here’s a list of ORG TLD name servers. Ask one of these. NS .org ns.icann.org Here’s a list of ICANN name servers. Ask one of these. Ask ns.icann.org for for IPv6 address of ICANN.ORG The IPv6 adddress of www.icann.org 2001:500:88:200::7
- 18. | 18 Domain Name Registration 101 How to register a domain: • Choose a string e.g., example! • Visit a registrar to check string availability in a TLD • Pay a fee to register the name • Submit registration information • Registrar and registries manage: – “string” + TLD (managed in registry DB) – Contacts, DNS (managed in Whois) – DNS, status (managed in Whois DBs) – Payment information
- 19. | 19 DNS Resource Records (RR) • Unit of data in the Domain Name System • Define attributes for a domain name Label! !TTL !Class! Type !RData! www ! !3600 ! IN ! A ! 192.168.0.1! • Most common types of RR o A o AAAA o NS o SOA o MX o CNAME
- 20. | 20 What is a DNS zone data? • DNS zone data are hosted at an authoritative name server • Each “cut” has zone data (root, TLD, delegations) • DNS zones contain resource records that describe • name servers, • IP addresses, • Hosts, • Services • Cryptographic keys & signatures… Only US ASCII-7 letters, digits, and hyphens can be used as zone data. In a zone, IDNs strings begin with XN--
- 21. | 21 Common DNS Resource Records Time to live (TTL) • How long RRs are accurate Start of Authority (SOA) RR • Source: zone created here • Administrator’s email • Revision number of zone file Name Server (NS) • IN (Internet) • Name of authoritative server Mail Server (MX) • IN (Internet) • Name of mail server Sender Policy Framework (TXT) • Authorized mail senders
- 22. | 22 Common DNS Resource Records Name server address record • NS1 (name server name) • IN (Internet) • A (IPv4) * AAAA is IPv6 • IPv4 address (192.168.0.1) Web server address record • www (world wide web) • IN (Internet) • A (IPv4) * AAAA is IPv6 IPv4 address (192.168.0.2) File server address record • FTP (file transfer protocol) • IN (Internet) • CNAME means “same address spaces and numbers as www”
- 23. | 23 Places where DNS data lives Changes do not propagate instantly Registry DB Master Slave server Slave Cache server Not going to net if TTL>0 Might take up to ‘refresh’ to get data from master Upload of zone data is local policy
- 24. | 24 Delegating a Zone • Delegation is passing of authority for a subdomain to another party • Delegation is done by adding NS records – Ex: if icann.org wants to delegate ssr.icann.org ssr.icann.org. NS ns1.ssr.icann.org. ssr.icann.org. NS ns2.ssr.icann.org. • Now how can we go to ns1 and ns2? – We must add a Glue Record
- 25. | 25 Only this record needs glue! Glue Record • Glue is a ‘non-authoritative’ data • Don’t include glue for servers that are not in the sub zones ssr.icann.org. NS ns1.ssr.icann.org. ssr.icann.org. NS ns2.ssr.icann.org. ssr.icann.org. NS ns2.example.net. ssr.icann.org. NS ns1.example.net. ns1.ssr.icann.org. A 10.0.0.1 Ns2.ssr.icann.org. A 10.0.0.2 Glue Record!
- 26. | 26 Delegating ssr.icann.org. from icann.org. ns.ssr.icann.org 1. Setup minimum two servers 2. Create zone file with NS records 3. Add all ssr.icann.org data ns.icann.org 1. Add NS records and glue 2. Make sure there is no other data from the ssr.icann.org. zone in the zone file
- 27. Questions?