Re:Spoofing DNS with fragments
by gerdesj on Monday September 10, 2018 @07:46PM
(#17956084)
DNSSEC is probably the way forward. However it is bloody awful to implement, OK it isn't really but it is hard (not the same thing). I suggest that DNSSEC evangelists look at how Let's Encrypt are doing things for TLS certs and learn a few lessons.
Just in case I've put a nose out of joint: on a brand new Ubuntu Bionic minimal install with a NAT port forward to 80/tcp from WAN, I can get a LE cert with:
# apt install certbot
# certbot -d systemname.example.co.uk
Fill in a few questions as required and off we go. There is a systemd timer unit that automatically renews certs or you can use cron. Naively using both by accident does not matter. In general the LE system just works because clients have been designed to work like that (my general experience here is only Linux - Windows and Apples may have a different experience)
Now, DNSSEC has not been handled like LE. Window's DNS daemon seems to have DNSSEC built into the GUI (mmc) from at least 2012R2. The options on Linux and others are not quite so easy.
Just in case I've put a nose out of joint: on a brand new Ubuntu Bionic minimal install with a NAT port forward to 80/tcp from WAN, I can get a LE cert with:
# apt install certbot
# certbot -d systemname.example.co.uk
Fill in a few questions as required and off we go. There is a systemd timer unit that automatically renews certs or you can use cron. Naively using both by accident does not matter. In general the LE system just works because clients have been designed to work like that (my general experience here is only Linux - Windows and Apples may have a different experience)
Now, DNSSEC has not been handled like LE. Window's DNS daemon seems to have DNSSEC built into the GUI (mmc) from at least 2012R2. The options on Linux and others are not quite so easy.