Hi,
TL;DR
-----
DNSSEC validation will be enabled on BitFolk's resolvers on Monday
29th April.
The Plan
--------
After consultation¹, we've come up with a plan for enabling DNSSEC
validation on BitFolk's resolvers:
0. As of Wednesday 27th a test resolver has been available on
85.119.80.243, with validation enabled. You can either query
through it directly, e.g.:
dig -t a www.dnssec-failed.org @85.119.80.243
dig -t test.dnssec-or-not.net @85.119.80.243
or replace all IPs in your /etc/resolv.conf to send all your DNS
queries through it.
1. Sometime on Saturday 30th March (tomorrow) we'll enable Unbound's
"permissive mode" which performs validation and logs errors but
always passes answers back to clients anyway:
http://unbound.net/documentation/howto_turnoff_dnssec.html
Note that this can give the impression that DNSSEC is in use, but
it is strictly for testing and you are achieving no security
benefit while this setting is in effect.
2. Around Saturday 6th April we'll review the logs to see what sort
of impact real validation will have.
We will not be examining each and every failure and we will not
be providing per-customer details; it is your responsibility to
make use of the test resolver if you wish to test your own
queries.
3. Provided the results of stage 2 are not too shocking, validation
will be switched on sometime on Monday 29th April, deliberately a
working day so that those of you using your VPSes for business
purposes will hopefully be around to spot any issues in the
unlikely event of anything breaking.
Frequently Asked Questions
--------------------------
- What is DNSSEC?
DNSSEC is a means by which DNS domain owners can digitally sign
records in their zones, so that DNS resolvers can check that the
answers they are receiving have not been tampered with at any
stage.
Aside from routine mangling of DNS responses done by local
resolvers not under your control (think: the built-in DNS resolver
in the access point of your hotel, or an ISP resolver that for
some reason is set to monetise particular kinds of queries), there
are other threats such as the hijacking for DNS for popular or
critical sites.
Additionally, digital signing of zone content is needed before you
can trust other secure data that might be stored in the DNS such
as cryptographic public keys, e.g. SSH host keys and DANE data.
RFC 3833 - Threat Analysis of the Domain Name System (DNS):
http://tools.ietf.org/html/rfc3833
If a DNS zone is DNSSEC-signed but the signatures fail validation,
the query will typically fail with a SERVFAIL response instead of
the expected answer.
- Do I need to do anything?
No; validation is configured in the resolver, and BitFolk runs the
resolvers that are listed by default in your /etc/resolv.conf.
More and more resolvers will start enabling DNSSEC so you may like
to test it out for yourself ahead of time though.
- I'm running a DNS server on my VPS for my domain. Do I need to change
anything?
No; this is about the DNS resolvers you use which are defined in
your /etc/resolv.conf, not any DNS server you might be running to
serve authoritative DNS data. Whether or not you enable DNSSEC
signing for your domain is a separate (and more complicated)
issue.
- Does this mean bitfolk.com will be DNSSEC-signed?
No; having resolvers that validate DNSSEC signatures is a necessary
first step before we can consider DNSSEC-signing bitfolk.com and
bitfolk.co.uk.
- Am I secure as soon as this is enabled?
Only if the domains you query have enabled DNSSEC. And only for
the things that DNSSEC actually protects you against.
If you have any further questions about any of this, please do reply
here or contact us off-list at support(a)bitfolk.com.
Cheers,
Andy
¹ Thread on users list starts here:
http://lists.bitfolk.com/lurker/message/20130326.230706.21113786.en.html
--
http://bitfolk.com/ -- No-nonsense VPS hosting
> The optimum programming team size is 1.
Has Jurassic Park taught us nothing? — pfilandr
On Thu, Apr 25, 2013 at 01:57:10PM +0100, Murray Crane wrote:
> Pedantry on my part, but 13.04 isn't an LTS release, that "honour" is
> reserved for even year April releases (10.04, 12.04, 14.04...).
Not pedantry at all, I will need to correct that, thanks.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
Hi,
Ubuntu 13.04 LTS was released today.
https://wiki.ubuntu.com/RaringRingtail/ReleaseNotes
For those eager to try it out, I've created an entry within the
self-installer that allows you to do a clean install of it.
https://tools.bitfolk.com/wiki/Using_the_self-serve_net_installer
I tested that it boots and can be SSHed into over IPv4 and v6, but
that is as far as my testing went.
I haven't tried an upgrade from 10.04.x; if anyone does give that a
go then creating a wiki page with any gotchas would be appreciated.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
Hi,
Those with secondary DNS service with BitFolk will have received a
number of alerts regarding b.authns.bitfolk.com over the last couple
of hours.
The ISP concerned seems to be having some networking issues
that's affecting their IPv4 but not IPv6. I've reported the problems
to them and disabled alerting for that host until they fix it.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
