DNSSEC Workshop

Introduction 

 Hands on DNS and DNSSEC Three day course – Philip Paeps 

 Objectives 

 At the end of this course, participants will be familiar with the Domain Name System and Security Extensions to the Domain Name System (DNSSEC). The course is taught "hands-on" in a virtualised FreeBSD environment. Participants will configure authoritative and recursive domain name servers and will learn to analyse and debug common misconfigurations and bugs 

 Prerequisites 

 Participants should be familiar with Unix-style operating systems. The course is taught on FreeBSD but the environment will be familiar to people with a systems administration background on Linux or Solaris. Participants should bring their own laptops. The virtualised lab environment is hosted on a server in Germany. Reliable internet connectivity with reasonable latency is required 

 Participants 

 Systems administrators and network operators responsible for the DNS services in their organisation. 

 Workshop Requirements 

 

 Some understanding of DNS is required (for example, operational experience managing DNS servers is useful) 

 Some knowledge of Linux/UNIX command line 

 Good understanding of network basics (IP networking) 

 All participants will need to bring a laptop with WiFi access. You cannot use a tablet for this workshop. 

 

 Instructors 

 Philip Paeps 

 Agenda 

 

 

 

 Time 

 Day 1: Sunday 23 August 

 Day 2: Monday 24 August 

 Day 3: Tuesday 25 

 

 

 08:30 – 09:15 (45 minutes) 

 Registration and coffee 

 Registration and coffee 

 Registration and coffee 

 

 

 09:15 – 11:15 (120 minutes) 

 • Introduction to DNS • Resource records • Delegation • Queries, responses and flags 

 •Configuring authoritative nameservers • Setting up DNS zonefiles • Delegating authority • Debugging common zonefile problems 

 • Introduction to DNSSEC • New resource records and flags in DNSSEC • Validating a domain from the root step by step 

 

 

 11:15 – 11:30 (15 minutes) 

 Coffee break 

 Coffee break 

 Coffee break 

 

 

 11:30 – 13:00 (90 minutes) 

 • DNS packet analysis • DNS data flow • DNS vulnerabilities 

 • Very brief introduction to cryptography •Using TSIG to secure queries 

 • Key management: ZSKs and KSKs • Theory of key rollover and best practices 

 

 

 13:00 – 14:00 (60 minutes) 

 Lunch 

 Lunch 

 Lunch 

 

 

 14:00 – 15:30 (90 minutes) 

 • Tools: dig, drill, host, nslookup, tcpdump • Tools exercises • Resolving a domain from the root by hand 

 • Configuring secondary nameservers • Configuring TSIG to secure zone transfers • Debugging common zone transfer issues 

 • Manually signing a zone with BIND 9 • Configuring automatic DNSSEC with BIND 9 • Brief introduction to OpenDNSSEC 

 

 

 15:30 – 15:45 (15 minutes) 

 Coffee break 

 Coffee break 

 Coffee break 

 

 

 15:45 – 16:30 (45 minutes) 

 • Introduction to the lab environment • Discussion and Q&A 

 • Configuring unbound as a recursive resolver • Discussion and Q&A 

 • Configuring unbound with trust anchors • Demo with SSHFP and TLSA • Discussion and Q&A