Obtaining DNSSEC Logo

DNSSEC Logo is now issued by http://www.dnssec-logo.org/.

Once a domain is submitted, the zone admininistrator mentioned in the SOA record will receive an email on how to proceed.   There are three levels of certification:

Bronze - Zone is properly maintained, i.e. passes classical zone checks, and is correctly signed.

Silver - The KSK of the zone is correctly refered by the parent zone (if signed) or registered at one of the common TARs. During the last six months a ZSK rollover following the procedures of RFC 5011 was observed.

Gold - During the last year a KSK rollover following the procedures of RFC 5011 including the parental delegations was observed. Access is granted to the zone contents for exhaustive RRSIG checks.

I shall apply for DNSSEC logo in order to test my capability of managing DNSSEC.

DNSSEC Signature Expiry

What will happen if the stub resolver of a browser works on DNSSEC only and the signature of a address record of the domain name have expired.  The simple answer is that the browser can not allow access to the site.  My captured picture is attached below (see the red warning key).

Changing the default resolvers assigned by DHCP

One of my Linux machines get IP address from DHCP Server and as a result, the resolvers are pre-assigned in the file /etc/resolv.conf.   I wanted to use my local DNSSEC-aware resolver @127.0.0.1.  My way of doing this is to add the following in /etc/rc.d/rc.local :

cat /dev/null > /etc/resolv.conf
echo "nameserver 127.0.0.1" >> /etc/resolv.conf
service named restart
rndc flush

CPU Thermal Shutdown due to heat generated from display card

One of my desktop PC with Intel motherboard D865PERL experienced frequent thermal shutdown after booting up for several minutes.  The CPU heat sink was not hot at all.  I guessed the motherboard sensors detected excessive heat from devices close to the CPU. Without doubt, this should be the display card.  What I tried to do was to do a CMOS reset and then replace the fan of the display card.  

Things got normal now.

Fedora Core 13 on a USB memory stick

I used Live USB Creator to make Fedora Core running on a 2GB USB stick.  The amount of persistent storage was set to 700 MB.   Guess what, everything is so smooth.  I can boot up the USB to have a working desktop version of Fedora Core 13.  Since there is space for persistent storage, user profiles, file moves and changes can be saved.    It is a thriving experience.

Root trust anchor and DNSSEC Lookaside Validation Registry working side by side

Previously, I had the idea that DLV Registry scheme administered by the Internet System Consortium (ISC) would cease operation after 15 July 2010 when the root zone is signed. Recently, I have come across the config file of a recursive validator running BIND 9.7.1 and found that DLV is supplementing the root trust anchor. This is great since DLV Registry has a large number of domains already deploying DNSSEC but their parent zones (such as .com, .net or .hk etc) have not started DNSSEC operation and provided signing for their child zones.

Without DLV, in the absence of a fully signed path from root to a zone, users wishing to enable DNSSEC-aware resolvers would have to configure and maintain multiple trusted keys into their configuration. Maintaining multiple trusted keys by hand is an unmanageable task. ISC DLV removes this need by serving as a trusted repository of entry points through which those keys can be securely retrieved by the resolver when it needs them.

Here is the named.conf for Bind 9.7 using root trust anchor and DLV:

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
// listen-on port 53 { 127.0.0.1; };
 listen-on-v6 port 53 { ::1; };
 directory  "/var/named";
 dump-file  "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
 allow-query     { localhost; 192.168.73.0/24; };
 recursion yes;

 dnssec-enable yes;
 dnssec-validation yes;
 dnssec-lookaside auto;

 /* Path to ISC DLV key */
 bindkeys-file "/etc/named.iscdlv.key";
};
trusted-keys { 
"." 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0="; };
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
 type hint;
 file "named.ca";
};

include "/etc/named.rfc1912.zones";

// End of config

15 % of all .cz domains are DNSSEC-secured

Congratulations to the Czech Republic (.cz) Government.  There are about 700K “.cz” registered domains but as of today, over 100K are DNSSEC-secured. This is really a world leading position in infrastructure and application security.

Firefox dnssec validator

On my FC13 box running Bind 9.7 for name resolution, the Firefox browser is now having the dnssec-validator as an add-on tool.   Here is the result of accessing a website with dnssec RRSIG in domain part of the browser (note the green key):

However, if the same add-on is added to Firefox in Windows XP environment, the dnssec signatures failed to authenticate:

Root trust anchor tested successfully

I have a notebook PC installed with Centos 5.5 and the bind version was upgraded to Bind 9.7.0.P1 which support the root KSK (trust anchor) in SHA256 algorithm.  Using the following root trust anchor in name.conf :

 "." 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8g
cCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUe
VPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvP
VjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6D
oBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRL
KBP1dfwhYB4N7knNnulqQxA+Uk1ihz0=";

Here is what I got when resolving the www.isoc.org with dnssec-enabled query:

That is to say, I have successfully deployed the root trust anchor in a resolver.

root dnskey used SHA-256 algorithm

Just when I thought it was the right time to include root KSK (dnskey) as the trust anchor for a resolver, I then realized that the root KSK was generated with SHA-256 algorithm:

trust-anchor: ". DS 19036 8 2 49AAC11D7B6F6446702E54A1607

371607A1A41855200FD2CE1CDDE32F24E8FB5"

My resolvers running Bind 9.5.2 and Unbound 1.3.4 can not support this algorithm.   Thats say, I am not able to use the root key as the trust anchor.  Time to move to Bind 9.7 and Unbound 1.4.4

.

HEAD / HTTP/1.0

I have tried some simple tricks to do web server fingerprinting by issuing "HEAD / HTTP/1.0" after telnet to port 80 of the web server IP address:

**** capture *****

# telnet 58.64.165.185 80
Trying 58.64.165.185...
Connected to 58.64.165.185.
Escape character is '^]'.
HEAD / HTTP/1.0
[Note :two CR pressed afterwards]
HTTP/1.1 200 OK
Content-Length: 5482
Content-Type: text/html
Content-Location: http://58.64.165.185/Index.html
Last-Modified: Sat, 16 May 2009 19:00:08 GMT
Accept-Ranges: bytes
ETag: "3888e08758d6c91:17665"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 17 Jul 2010 16:38:23 GMT
Connection: close

Connection closed by foreign host.

**** End of capture *****

I remember two other methods to do the same; one is httprint and the other is nmap.

Root zone is serving DNSSEC now

After many years of planning and trial, the root zone is now signed with DNSSEC keys. See the screen dump below.

From my observations, the root zone will be signed twice a month by the Zone Signing Key, double the pace of an ordinary fully qualified domain name which is to be signed on a monthly basis. Also, according to ICANN, the Key Signing Key shall be used for 5 years. This introduces only a slight additional burden to include the default secure entry point to a resolver every 5 years.

My wholehearted thanks go to ICANN and all root zone operators for taking major steps to secure the public Internet.
 

No more IE

I have convinced all my family members to stop using buggy unsecure Microsoft IE. We have Safari, Chrome and Firefox all providing browser capability. Goodbye to your rubbish bundle, Mr Bill Gates and Steve Ballmer !

 

 

ICANN finally approved .xxx top level domain

In April 2006, I wrote on my blog casting doubt on ICANN's non-sensible decision of not allowing .xxx top level domain for porn sites.   ICANN has recently announced the approval.

With an estimated 370 million adult websites on the Internet, porn websites certainly deserve their own top level domain just like .com, .net or .org.   The benefit is that adult sites not suitable for children can be filtered very easily.  I must say the new management of ICANN is very open-minded, effective and efficient.  Just look at the recent progress of introduction of new gTLDs, IDNs, IDN for ccTLDs and DNSSEC signing of the root zone.

Opera can show thumbnail of webpage in tab bar

Showing thumbnail of a webpage in tab bar is a unique feature of Opera.  In tab browsing, suppose I have opened many tags, I might find it difficult to navigate from one tab to another by just looking at the text on the tab bar.  With thumbnail in opened tabs,  I am sure I can get back to the right page.

In Chrome, there is something even more powerful called tab review.  It is a plug-in which can be installed easily.

Microsoft should learn from Google and Opera.

A nice 404 error page

This is the most impressive 404 Error Page that I have ever seen:

While you will be amazed by the enlarged 404 wordings, you will be impressed by the rich menu on the right hand side which provide sufficient guidance to visitors.

UPS Delivery Virus

I've got the infamous UPS delivery virus in my mailbox:

Of course, the attached zip file contains a virus.  This virus has been found since 2008.

NAT NAT

Today, I saw a van with the car plate "NAT NAT". Presumably, the car owner is an IT Manager and he even deploys double NAT in his company's network. I have no doubt that this guy will keep using IPv4 and he will not move to IPv6 as he loves NAT so much. How many such guys are there in the IT Sector ?

Shall I give him a lesson on IPv6 ?

URL too long encountered by Chrome

This is the first time I notice about the error message "URL Too Long" in Chrome.

The same webpage and same URL can be opende in IE 8.   Is this a compatibility problem of Chrome ?   On security concern, there might be a need to limit the maximum length of URL in order to avoid buffer overflow or other types of attack.  I guess it is not easy to find the answers.

6 IT people of HK get IPv6 Sage status as of today

I checked Hurricane Electric IPv6 certification website and noticed that as of  today there are 6 IT people attained Sage level.  They are:

1. Warren Kwok
2. Jacky Tsoi
3. Joe Ho
4. Charles Low
5. Sang Young
6. Billy Yim

Since APNIC will conduct IPv6 training in HK next week, we can expect more IT people getting Sage certification by this year end.  Stay tuned.