Lesser known DNS tools and BIND tricks

Transcription

1 Lesser known DNS tools and BIND tricks dnsworkshop.org August /56

2 About me 2/56

3 6502 Basic Forth Assembler 3/56

4 8086 MS DOS Pascal C Assembler 4/56

5 Power CPU AS/400 CL RPG SNA 5/56

6 386 OS/2 Rexx Modula Oberon Java NetBIOS 6/56

7 Unix Solaris Linux OpenBSD FreeBSD TCP/IP 7/56

8 Network DNS DHCP IPv6 DNSSEC 8/56

9 Work Men & Mice ISC LinuxHotel 9/56

10 DNS lookup 10/56

11 quick DNS lookup DNS lookup tool, easy to parse output dnsget guug.de or dig guug.de +short 11/56

12 pretty print DNS pretty print dns results dig soa dnsworkshop.org +multiline 12/56

13 checking SOA records lookup SOA record from all authoritative DNS servers of a zone dig dnsworkshop.org +nssearch 13/56

14 map DNS names in a zone brute force map all DNS names in a zone dnsmap guug.de 14/56

15 bulk resolve names asynchronous DNS to resolve names (or IP addresses to names) in logfiles cat queryfile example 1million head adnshost af 15/56

16 DNS resolve filter resolve IP addresses to names in a filter lsof i n adnsresfilter 16/56

17 browse multicast DNS Bonjour / Rendezvous / Avahi DNS service discovery browser avahi browse or mdns scan 17/56

18 mailserver for a domain quick find the mailserver for a domain ldns mx isc.org 18/56

19 a terse display of a zone print a parse able tree view of a DNS zone dns_tree gnu.org 19/56

20 graphical DNS and DNSSEC lookup tool 20/56

21 monitoring 21/56

22 find version of server print the version information reported by a DNS server ldns chaos f.root servers.net 22/56

23 fingerprint DNS servers find server software and versions by fingerprinting DNS responses fpdns Df google.com 23/56

24 measure DNS latency measure the DNS response time echoping n 20 m dns dnsworkshop.org 24/56

25 monitor DNS queries monitor all DNS queries seen by the local machine sudo dnstop l 3 eth0 25/56

26 monitor or capture DNS queries dnscap is a traffic capturing tool for DNS sudo dnscap g 26/56

27 visualize DNS traffic flow # sudo tcpdump i eth0 w dnsdump.pcap port 53 # dnspktflow dnsdump.pcap # eog out.png 27/56

28 troubleshooting 28/56

29 trace the delegation tree dig dnsworkshop.org +trace or dnstracer s. 29/56

30 check a domain for issues download a zonefile and checks for issues dnswalk gnu.org. 30/56

31 check your zone for errors the zonecheck tool (on the Internet or installed locally) 31/56

32 visualize a DNS zone # axfr gnu.org +onesoa > gnu.org zone # mapper gnu.org zone gnu.org # eog map.png 32/56

33 DNSSEC 33/56

34 check resolver for DNSSEC compliance 34/56

35 SSH fingerprint resource records generate sshfp records from your known hosts file sshfp 35/56

36 Walk a NSEC signed zone traverse all domain names in a zone that is NSEC signed ldns walk paypal.com or walker paypal.com 36/56

37 trace the 'chain of trust' tracing the chain of trust to the root trust anchor # drill dnskey. grep 257 > root.key # drill SD k root.key 37/56

38 peek into a validating resolver unbound host lets you view every step of DNSSEC validation unbound host C /etc/unbound/unbound.conf dvv 38/56

39 sanity check a DNSSEC signed zone check a DNSSEC signed zone for issues donuts r "/usr/share/dnssec tools/donuts/rules/*.txt" \ dnsworkshop.org zonefile dnsworkshop.org or ldns verify dnsworkshop.org zonefile 39/56

40 BIND 40/56

41 statistics channel over http acl myadmins { ; ; }; statistics channels { inet * port 8053 allow { myadmins; }; }; 41/56

42 check config + zonefiles before reload verify named.conf (and all zonefiles loaded) for syntax errors named checkconf z 42/56

43 pretty print a configuration file if you see a messed up BIND config, pretty print it named checkconf p > named.conf 43/56

44 pretty print the canonical form of a zone some errors are hiding in shortcuts named checkzone D problemdomain.com problemdomain.com zone 44/56

45 tune the concurrent client setting adjust recursive clients to real world value on a busy caching DNS server options { [...] recursive clients 2000; tcp clients 200; }; 45/56

46 limit the size of the cache a BIND caching DNS server gets slower with a large cache (> 2GB) options { [...] max cache size ; // 2GB max cache }; 46/56

47 compile zones to binary format for fast startup compile a text version of a zone to "raw" binary format # named compilezone F raw o gnu.org raw gnu.org gnu.org zone zone gnu.org/in: loaded serial dump zone to gnu.org raw...done OK and in named.conf zone "example.com" { type master; file "example.com.raw"; masterfile format raw; }; 47/56

48 convert from RAW zone format to text format BIND 9.9.x+ creates RAW files by default (for slave and stub zones) named compilezone f raw o slave.example.org text \ slave.example.org slave.example.org this command turns them into RFC 1035 text format 48/56

49 print the content of a journal file BIND collects changes for dynamic zones in a binary journal file named journalprint dynamic.signed.dnslab.org.jnl 49/56

50 simple dynamic zone setup (BIND ) enable dynamic updates zone "example.com" { type master; file "example.com zone"; update policy local; }; and use "nsupdate" to make changes to the zone (from the DNS server machine) # nsupdate l > update add IN A > update delete old.example.com. A > send 50/56

51 FUN 51/56

52 Bert's Secure Reverse Polish DNS Calculator (BSRPDNSC) Try Bert's Secure Reverse Polish DNS Calculator (BSRPDNSC). This is nice because you don't need your HP48 or Forth to do serious RPN calculations: # dig "9.dup.*.rp.secret wg.org" TXT 52/56

53 Wikipedia over DNS no web browser to lookup things in Wikipedia? Use DNS # dig txt guug.wp.dg.cx 53/56

54 Query the lastest twitter news over DNS who needs a twitter client? dig guug.twitter.any.io txt +short 54/56

55 Thank you Links to the tools and web pages mentioned in this talk can be found on dnsworkshop.org 55/56

56 56/56