Exercise 54: Configuring DNSSEC to Prevent DNS Spoofing

Objective

Implement DNSSEC (Domain Name System Security Extensions) to protect against DNS spoofing and cache poisoning attacks. Learn how to configure a DNS server with DNSSEC, sign DNS records, and verify secure responses.

---

Scenario

Attackers can exploit the lack of DNS security to perform DNS spoofing and cache poisoning, redirecting users to malicious sites. DNSSEC adds a layer of security by digitally signing DNS records, ensuring their authenticity and integrity. In this exercise, you’ll configure a DNS server with DNSSEC to safeguard DNS queries.

⚠️ Important: This exercise must be performed in a legal and controlled environment. Misconfiguration of DNS servers in production can disrupt services.

---

Lab Instructions

Step 1: Set Up the DNS Server

a. Install Bind9 DNS Server

sudo apt update
sudo apt install bind9 dnsutils -y

b. Configure the Zone File

sudo nano /etc/bind/named.conf.local

• Add the following configuration:

zone "example.com" {
    type master;
    file "/etc/bind/zones/db.example.com";
    allow-transfer { none; };
};

c. Create the Zone File

sudo mkdir -p /etc/bind/zones
sudo nano /etc/bind/zones/db.example.com

• Example zone file content:

$TTL 604800
@   IN  SOA ns1.example.com. admin.example.com. (
            2         ; Serial
            604800    ; Refresh
            86400     ; Retry
            2419200   ; Expire
            604800 )  ; Negative Cache TTL
;
@       IN  NS      ns1.example.com.
ns1     IN  A       192.168.1.1
www     IN  A       192.168.1.2

Step 2: Generate DNSSEC Keys

a. Create the Zone Signing Key (ZSK)

sudo dnssec-keygen -a RSASHA256 -b 2048 -n ZONE example.com

b. Create the Key Signing Key (KSK)

sudo dnssec-keygen -a RSASHA256 -b 4096 -n ZONE -f KSK example.com

c. Add DNSSEC Keys to the Zone File

sudo cat Kexample.com*.key | sudo tee -a /etc/bind/zones/db.example.com

Step 3: Sign the Zone

a. Sign the Zone File

sudo dnssec-signzone -A -3 $(head -c 1000 /dev/urandom | sha1sum | cut -b 1-16) \
    -N increment -o example.com -t /etc/bind/zones/db.example.com

b. Update the Bind9 Configuration

sudo nano /etc/bind/named.conf.local

• Modify the zone configuration:

zone "example.com" {
    type master;
    file "/etc/bind/zones/db.example.com.signed";
};

c. Restart Bind9

sudo systemctl restart bind9

Step 4: Verify DNSSEC Functionality

a. Query DNS Records with dig

dig +dnssec example.com

• Expected Result: The DNS response should include RRSIG records, indicating signed responses.

b. Verify DNSSEC Validation

dig +dnssec +multi example.com

• Look for the ad (Authenticated Data) flag in the response, confirming successful validation.

Step 5: Discuss the Importance of DNSSEC

1. Prevents DNS Spoofing: DNSSEC ensures DNS responses are authentic and tamper-proof.
2. Mitigates Cache Poisoning: Signed records prevent attackers from injecting malicious data into DNS caches.
3. Integrity Verification: DNS data is verified through cryptographic signatures.
4. End-to-End Trust: Builds a secure DNS hierarchy from root servers to end users.

---

Solution & Explanation

How DNSSEC Works

• Digital Signatures: DNSSEC uses cryptographic signatures (RRSIG) to authenticate DNS records.
• Public Keys: DNS resolvers use public keys (DNSKEY) to verify signatures.
• Chain of Trust: Starts from the root zone, ensuring every DNS level is verified.

Why DNSSEC Is Essential

• Prevents Man-in-the-Middle (MITM) Attacks: Validates DNS data.
• Secures Critical Services: Protects web services, emails, and other applications reliant on DNS.

Mitigation Techniques Without DNSSEC

1. Strict Access Controls: Limit who can modify DNS records.
2. Split DNS: Separate internal and external DNS.
3. Firewall Rules: Restrict DNS traffic to trusted sources.

---

Testing & Verification

1. Before DNSSEC: DNS responses are unsigned and susceptible to spoofing.
2. After DNSSEC: Responses include cryptographic signatures, ensuring integrity.

Confirm Signed Records

dig +dnssec example.com

Validate RRSIG Records

dig DNSKEY example.com +short

---

Security Best Practices

1. Regularly Rotate Keys: Periodically update ZSK and KSK keys.
2. Monitor DNS Logs: Detect unauthorized changes.
3. Use Trusted Resolvers: Configure DNS resolvers that support DNSSEC validation.
4. Secure DNS Infrastructure: Apply proper access controls and firewall rules.

---

Additional Script (Optional)

Automate DNSSEC Key Generation and Zone Signing:

#!/bin/bash
# Automate DNSSEC Key Generation and Zone Signing
ZONE="example.com"
ZONE_FILE="/etc/bind/zones/db.$ZONE"

# Generate ZSK and KSK
sudo dnssec-keygen -a RSASHA256 -b 2048 -n ZONE $ZONE
sudo dnssec-keygen -a RSASHA256 -b 4096 -n ZONE -f KSK $ZONE

# Append keys to zone file
sudo cat K$ZONE*.key | sudo tee -a $ZONE_FILE

# Sign the zone
sudo dnssec-signzone -A -3 $(head -c 1000 /dev/urandom | sha1sum | cut -b 1-16) \
    -N increment -o $ZONE -t $ZONE_FILE

# Restart Bind9
sudo systemctl restart bind9

echo "DNSSEC configuration for $ZONE is complete."

---

Conclusion

In this exercise, you configured a DNS server with DNSSEC to secure DNS records against spoofing and cache poisoning. You generated cryptographic keys, signed DNS records, verified signed responses, and explored best practices for securing DNS infrastructure.