Service/Nameservers - Revision history

Bernie: /* CLI tools */

2023-07-15T19:35:25Z

CLI tools

← Older revision		Revision as of 15:35, 15 July 2023
Line 133:		Line 133:
	* Validate zone data with dig:		* Validate zone data with dig:
	dig +dnssec +multiline -t ns codewiz.org. @1.1.1.1 \| grep ad		dig +dnssec +multiline -t ns codewiz.org. @1.1.1.1 \| grep ad
			;; flags: qr rd ra ad; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

	* Validate zone data against domain DNSKEY:		* Validate zone data against domain DNSKEY:
Line 141:		Line 142:

	* Validate zone data against a domain's DS key:		* Validate zone data against a domain's DS key:
	unbound-host -~~y 'codewiz~~.org. ~~DS 53631 13 2 C31F7790197F0DC5CE7726F731FA55A9189289540749A68A937BFD09 797D72E6'~~ -v codewiz.org		unbound-host -f keys/dsset-sugarlabs.org. -v sugarlabs.org
			sugarlabs.org has address 185.199.111.153 (secure)
			sugarlabs.org has address 185.199.110.153 (secure)
			sugarlabs.org has no IPv6 address (secure)
			sugarlabs.org mail is handled by 10 mail0.codewiz.org. (secure)
			sugarlabs.org mail is handled by 20 sunjammer.sugarlabs.org. (secure)

	* Validate zone data against root DNSKEY:		* Validate zone data against the root DNSKEY:
	unbound-host -D -~~y '~~. DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0=' -v codewiz.org		unbound-host -D -v wiki.sugarlabs.org
			wiki.sugarlabs.org is an alias for sunjammer.sugarlabs.org. (secure)
			sunjammer.sugarlabs.org has address 209.51.188.53 (secure)
			sunjammer.sugarlabs.org has IPv6 address 2001:470:142:7::11 (secure)
			sunjammer.sugarlabs.org has no mail handler record (secure)

Bernie: /* Checkout nameserver config */

2023-07-15T19:23:32Z

Checkout nameserver config

← Older revision		Revision as of 15:23, 15 July 2023
Line 53:		Line 53:
	git clone lightwave.sugarlabs.org:/var/lib/bind/etc/bind ns		git clone lightwave.sugarlabs.org:/var/lib/bind/etc/bind ns

	'''~~IMPORTANT~~:''' ~~Do not checkout the repository as root.~~ Your user on [[Machine/lightwave]] needs to be in group hostmaster.		'''NOTE:''' Your user on [[Machine/lightwave]] needs to be in group hostmaster. Do not clone the repo on lightwave, clone it to your local host.

	~~In order to make~~ changes, you will also need the private keys for your domain. For security reasons, these		To push changes, you will also need the DNSSEC private keys for your domain. For security reasons, these
	are not kept on the master DNS itself. Ask one of the other hostmasters for a copy and put it in the keys/		are not kept on the master DNS itself. Ask one of the other hostmasters for a copy and put it in the keys/
	directory alongside the public keys.		directory alongside the public keys.

Bernie at 07:33, 31 July 2022

2022-07-31T07:33:10Z

← Older revision		Revision as of 03:33, 31 July 2022
Line 53:		Line 53:
	git clone lightwave.sugarlabs.org:/var/lib/bind/etc/bind ns		git clone lightwave.sugarlabs.org:/var/lib/bind/etc/bind ns

	Do not checkout the repository as root. Your user on [[Machine/lightwave]] needs to be in group hostmaster.		'''IMPORTANT:''' Do not checkout the repository as root. Your user on [[Machine/lightwave]] needs to be in group hostmaster.

	In order to make changes, you will also need the private keys for your domain. For security reasons, these		In order to make changes, you will also need the private keys for your domain. For security reasons, these

Bernie at 07:31, 31 July 2022

2022-07-31T07:31:09Z

← Older revision		Revision as of 03:31, 31 July 2022
Line 25:		Line 25:
	! '''ns1.sugarlabs.org'''		! '''ns1.sugarlabs.org'''
	\| lightwave		\| lightwave
	\| ~~MIT Media Lab~~, ~~Cambridge~~, USA		\| Sonic, Santa Rosa CA, USA
	\| 18.85.44.64		\| 192.184.220.216
	\| ~~2002~~:~~1255~~:~~2c40~~::~~1 BROKEN~~		\| 2001:5a8:601:f::216/64
	\|-		\|-
	\| ns2.sugarlabs.net		\| ns2.sugarlabs.net
Line 89:		Line 89:
	For other domains hosted on Sugar Labs infrastructure (such as eg. somosazucar.org) use:		For other domains hosted on Sugar Labs infrastructure (such as eg. somosazucar.org) use:

	./update-zone ~~somosazucar~~.org		./update-zone turtleartday.org

	This will check the zone before pushing.		This will check the zone before pushing.
Line 102:		Line 102:

	=== How to create keys for a new domain ===		=== How to create keys for a new domain ===

			We standardized on algorithm 13 (ECDSAP256SHA256) because it's what RFC 8624 recommends and what Cloudflare uses:

	cd keys		cd keys
	dnssec-keygen -a ~~RSASHA1 -b 1024~~ -n ZONE codewiz.org		dnssec-keygen -K keys -3 -a ECDSAP256SHA256 -n ZONE codewiz.org
	dnssec-keygen -a ~~RSASHA1 -b 2048~~ -n ZONE -f KSK codewiz.org		dnssec-keygen -K keys -3 -a ECDSAP256SHA256 -n ZONE -f KSK codewiz.org

	=== How to manually sign a zone ===		=== How to manually sign a zone ===
Line 118:		Line 121:
	The data to copy is written by dnssec-signzone to the file keys/dsset-DOMAIN and looks like this:		The data to copy is written by dnssec-signzone to the file keys/dsset-DOMAIN and looks like this:

	~~codewiz.org. IN DS 7082 8 2 422B9AD0529099938BAB245BD189BBCF485A9194FC35BA3BB04894E9 C914554A~~
	codewiz.org. IN DS 53631 13 2 C31F7790197F0DC5CE7726F731FA55A9189289540749A68A937BFD09 797D72E6		codewiz.org. IN DS 53631 13 2 C31F7790197F0DC5CE7726F731FA55A9189289540749A68A937BFD09 797D72E6

Line 133:		Line 135:

	* Validate zone data against domain DNSKEY:		* Validate zone data against domain DNSKEY:
	unbound-host -y 'codewiz.org. IN DNSKEY 256 3 ~~5 AwEAAa3dS5/3fkGXuqXft2dN/UPUivGqiYzZF~~+~~jWcow8LTAnlsoYaJFB VMAlJWbC6FFI7AMjoJYpmoeDMgHd4BtVqZO2ikx5zc48CtOUHUdXs7nw fMSQoVOnplpTKH2AgyRfDqYhtosP0euyJQNZI~~+~~NiYneZb1o1Ys7PE87Y 7FamjXwV~~' -v codewiz.org		$ unbound-host -y 'codewiz.org. DNSKEY 256 3 13 IbIcUsP+G7cnSmi12BpuiMjM9LnqvDaRS+qiquGKXxH/qAuOGlODFA4E 18O1OErfu0CkFjg6JEynOG6cSR40yg==' -v codewiz.org
			codewiz.org has address 209.51.188.53 (secure)
			codewiz.org has IPv6 address 2001:470:142:7::11 (secure)
			codewiz.org mail is handled by 10 neo.develer.net. (secure)

	* Validate zone data against domain DS key:		* Validate zone data against a domain's DS key:
	unbound-host -y 'codewiz.org. IN DS ~~58126 5~~ 2 ~~96BF1964F3EA9885F5DE83DA14419F55F579A42BC18759C1B79BDE64 7587CFA8~~' -v codewiz.org		unbound-host -y 'codewiz.org. DS 53631 13 2 C31F7790197F0DC5CE7726F731FA55A9189289540749A68A937BFD09 797D72E6' -v codewiz.org

	* Validate zone data against root DNSKEY:		* Validate zone data against root DNSKEY:
	unbound-host -y '. DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0=' -v codewiz.org		unbound-host -D -y '. DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0=' -v codewiz.org

Bernie at 09:06, 6 February 2022

2022-02-06T09:06:07Z

← Older revision		Revision as of 05:06, 6 February 2022
Line 27:		Line 27:
	\| MIT Media Lab, Cambridge, USA		\| MIT Media Lab, Cambridge, USA
	\| 18.85.44.64		\| 18.85.44.64
	\| 2002:1255:2c40::1		\| 2002:1255:2c40::1 BROKEN
	\|-		\|-
	\| ns2.sugarlabs.net		\| ns2.sugarlabs.net
Line 33:		Line 33:
	\| FSF, Boston, USA		\| FSF, Boston, USA
	\| 208.118.235.53		\| 208.118.235.53
	\| 2001:~~4830~~:~~134~~:7::11		\| 2001:470:142:7::11
	\|-		\|-
	\| ns1.codewiz.org		\| ns1.codewiz.org

Bernie at 08:56, 6 February 2022

2022-02-06T08:56:53Z

← Older revision		Revision as of 04:56, 6 February 2022
Line 8:		Line 8:

	* [[User:Bernie\|Bernie Innocenti]]		* [[User:Bernie\|Bernie Innocenti]]
	* [[User:Scg\|Samuel Cantero]]

	(please use preferably the administrative address)		(please use preferably the administrative address)

Bernie at 05:47, 6 February 2022

2022-02-06T05:47:35Z

← Older revision		Revision as of 01:47, 6 February 2022
Line 124:		Line 124:
	=== How to validate zone data ===		=== How to validate zone data ===

	* Online validators		==== Online validators ====
	https://dnssec-analyzer.verisignlabs.com/codewiz.org		* https://dnssec-analyzer.verisignlabs.com/codewiz.org
			* https://dnsviz.net/d/codewiz.org/dnssec/

			==== CLI tools ====

	* Validate zone data with dig:		* Validate zone data with dig:

Bernie: Refresh DNSSEC docs

2022-02-06T05:41:19Z

Refresh DNSSEC docs

← Older revision		Revision as of 01:41, 6 February 2022
Line 104:		Line 104:
	=== How to create keys for a new domain ===		=== How to create keys for a new domain ===
	cd keys		cd keys
	dnssec-keygen ~~-r/dev/random~~ -a RSASHA1 -b 1024 -n ZONE codewiz.org		dnssec-keygen -a RSASHA1 -b 1024 -n ZONE codewiz.org
	dnssec-keygen ~~-r/dev/random -f KSK~~ -a RSASHA1 -b ~~1280~~ -n ZONE codewiz.org		dnssec-keygen -a RSASHA1 -b 2048 -n ZONE -f KSK codewiz.org

	~~(the above commands take a very long time!)~~

	=== How to manually sign a zone ===		=== How to manually sign a zone ===
	~~dnssec~~-~~signzone -o codewiz.org -K keys masters/codewiz.org.~~zone		Normally, you should use the update-zone script
	~~/etc/init.d/bind9 restart~~

	~~=== How to publish DLV records ===~~		dnssec-signzone -S -e +31536000 -K keys -d keys -o codewiz.org masters/codewiz.org.zone
			systemctl restart bind9

	~~Go to dlv.isc.org and upload the two DNSKEY~~ records ~~for each zone, then follow the instructions~~ to ~~validate them.~~		=== Add DS records to TLD ===
	~~This is the end result:~~

	* sugarlabs.~~org: https://dlv~~.~~isc.org/zones/3609~~		This step must be performed using the interface of the registrar (I used name.com).
	* sugarlabs.net: https://dlv.isc.org/zones/3612
	* codewiz.org: https://dlv.isc.org/zones/3607

	~~=== Add DS records~~ to ~~TLD ===~~		The data to copy is written by dnssec-signzone to the file keys/dsset-DOMAIN and looks like this:

	~~This step must be done by the registrar~~.		codewiz.org. IN DS 7082 8 2 422B9AD0529099938BAB245BD189BBCF485A9194FC35BA3BB04894E9 C914554A
			codewiz.org. IN DS 53631 13 2 C31F7790197F0DC5CE7726F731FA55A9189289540749A68A937BFD09 797D72E6

	~~I've opened a support ticket on [http://joker.com/ Joker] asking~~ to ~~add~~		=== How to validate zone data ===
	~~support for DS records. If they can't do it, we need to transfer~~
	~~sugarlabs.org to another registrar. At this time, the only decent choice~~
	~~for a DNSSEC enabled registrar is [http://name.com/ name.com].~~

			* Online validators
			https://dnssec-analyzer.verisignlabs.com/codewiz.org

	~~=== How to validate zone data ===~~

	* Validate zone data with dig:		* Validate zone data with dig:
	dig +dnssec +multiline -t ns codewiz.org. @~~localhost~~ \| grep ad		dig +dnssec +multiline -t ns codewiz.org. @1.1.1.1 \| grep ad

	* Validate zone data against domain DNSKEY:		* Validate zone data against domain DNSKEY:
Line 145:		Line 139:
	* Validate zone data against root DNSKEY:		* Validate zone data against root DNSKEY:
	unbound-host -y '. DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0=' -v codewiz.org		unbound-host -y '. DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0=' -v codewiz.org

	* Validate zone data online:
	~~http://secspider.cs.ucla.edu/codewiz-org--zone.html~~

	~~=== DNSSEC tutorial ===~~
	~~http://www.nlnetlabs.nl/publications/dnssec_howto/index.html#x1-290003.4~~

Bernie: Update addresses of ns1.codewiz.org

2019-06-24T13:14:22Z

Update addresses of ns1.codewiz.org

← Older revision		Revision as of 09:14, 24 June 2019
Line 37:		Line 37:
	\|-		\|-
	\| ns1.codewiz.org		\| ns1.codewiz.org
	\| ~~trinity~~		\| neo
	\| Develer, Firenze, Italy		\| Develer, Firenze, Italy
	\| 83.~~149~~.~~158~~.~~210~~		\| 2.228.72.10
	\| ~~2002~~:~~5395~~:~~9ed2~~::1		\| 2001:b02:400:1::10
	\|}		\|}

Bernie at 21:16, 5 December 2017

2017-12-05T21:16:35Z

← Older revision		Revision as of 17:16, 5 December 2017
Line 8:		Line 8:

	* [[User:Bernie\|Bernie Innocenti]]		* [[User:Bernie\|Bernie Innocenti]]
	* [[User:~~dogi~~\|~~Stefan Unterhauser]]~~		* [[User:Scg\|Samuel Cantero]]
	* [[User:sascha_silbe\|Sascha Silbe]]

	(please use preferably the administrative address)		(please use preferably the administrative address)