DNSSEC-Validator

###Listing 1: /etc/network/interfaces auto eth0 iface eth0 inet static address 198.51.100.66 netmask 255.255.255.0 network 198.51.100.0 broadcast 198.51.100.255 gateway 198.51.100.1 dns-nameservers 127.0.0.1 iface eth0 inet6 static address 2001:db8:591d:25c5::66 netmask 64 gateway 2001:db8:591d:25c5::1 ###Listing 2: /etc/sysctl.conf # Router Advertisements ignorieren net.ipv6.conf.default.accept_ra = 0 net.ipv6.conf.all.accept_ra = 0 net.ipv6.conf.eth0.accept_ra = 0 # IPv6 Autokonfiguration abschalten net.ipv6.conf.default.autoconf = 0 net.ipv6.conf.all.autoconf = 0 net.ipv6.conf.eth0.autoconf = 0 ###Listing 3: Standard-Webseite des Apache-Webservers DocumentRoot /var/www AllowOverride None Order allow,deny allow from all ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/ AllowOverride None Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch Order allow,deny Allow from all ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined ###Listing 4: CGI-Skript validator.pl #!/usr/bin/perl use strict; use CGI; use CGI::Carp 'fatalsToBrowser'; use Net::DNS::SEC::Validator; use Net::DNS::Packet; my $query = new CGI; my $fqdn = $query->param('fqdn'); my $validator = new Net::DNS::SEC::Validator(policy => ":"); $validator->policy("validate_tools:"); print $query->header(); print "DNSSEC-Validator"; if (!$fqdn) { print "
Kein FQDN übergeben!
"; exit; } my $r = $validator->res_query($fqdn, "IN", "A"); if (!$r) { print "
Kein DNS-Eintrag für $fqdn gefunden!
", "Überprüfen Sie, ob die Adresse korrekt ist."; exit; } my ($pkt, $err) = new Net::DNS::Packet(\$r); if (index($pkt->string,"RRSIG") == -1) { print "", "
$fqdn ist nicht DNSSEC-signiert!
\n"; exit; } if ($validator->istrusted) { print "", "
$fqdn ist vertrauenswürdig!
", "Die DNSSEC-Signatur konnte verifiziert werden.\n"; } else { print "", "
$fqdn ist NICHT vertrauenswürdig!
", "Die DNSSEC-Signatur konnte NICHT verifiziert werden.\n"; } print "\n"; ###Listing 5: Weitere Bibliotheken installieren apt-get install make apt-get install gcc apt-get install libssl-dev apt-get install libnet-dns-perl cd /home/testuser/ wget http://www.dnssec-tools.org/download/dnssec-tools-1.14.tar.gz tar xzf dnssec-tools-1.14.tar.gz cd dnssec-tools-1.14 ./configure make make install cd .. wget http://www.dnssec-tools.org/download/dnsval-1.14.tar.gz tar xzf dnsval-1.14.tar.gz cd dnsval-1.14 ./configure make make install cp etc/dnsval.conf /usr/local/etc/dnssec-tools/. cp etc/root.hints /usr/local/etc/dnssec-tools/. cd ..