Estou trabalhando em este exercício de Deterlab e me deparo com alguns problemas ao adicionar DNSSEC para vincular. O servidor executa o BIND 9.7.0-P1. As configurações que fiz são as seguintes: Zona assinada para google.com:
zonesigner -genkeys google.com
Adicionado .signed ao named.conf.local para google.com em arquivo.
Adicionado a named.conf.options:
dnssec-enabled yes;
dnssec-validation yes;
Adicionado ao named.conf:
include "/etc/bind/bind.keys";
com bind.keys:
trusted-keys {
. 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX
bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz
W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS
Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq
QxA+Uk1ihz0=";
};
Todos os arquivos compilam bem com o named-checkconf. Quando eu reiniciar bind e execute dig ainda não recebo o AD-bit:
sudo dig +dnssec www.google.com A
; <<>> DiG 9.7.0-P1 <<>> +dnssec www.google.com A
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20641
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;www.google.com. IN A
;; ANSWER SECTION:
www.google.com. 10 IN A 10.1.2.155
www.google.com. 10 IN RRSIG A 5 3 10 20160512120048 20160412120048 34206 google.com. QPVwvcsE5VXvMxnhS8/7LDwBWoTopQAuFPaRBeOSlARwTJkuReNgmqoL GcDD++zgS536YlrLGqAr+06fl2fnnnxtfwZUu6pwVmeosnmsU8b3Jd+b domXH138Ob1cBuS7Z5KDI94LkBfTu0ksFEBfcs7lCtvyY9zMw7BWhQ2L lnU=
;; AUTHORITY SECTION:
google.com. 604800 IN NS ns.google.com.
google.com. 604800 IN RRSIG NS 5 2 604800 20160512120048 20160412120048 34206 google.com. qnx8xI4qYfGBZ3GygxdCrgdoA7x8YwlYYVWPOntQax6Jzhof0V8FgQR6 FqXVVyOeA9aapVimYh45tI42WJ2DyNc8GgCX3xKwPdlmf3zrQqRKcr9F L/6tlLu+ZjBxPbQamLXueXM6m9eFSp9OMqj4EqDCCCA3fzXCkakQyv6P uIw=
;; ADDITIONAL SECTION:
ns.google.com. 10 IN A 10.1.2.3
ns.google.com. 10 IN RRSIG A 5 3 10 20160512120048 20160412120048 34206 google.com. ajOz8/kjZ0DWJRGqGQL9TEvBFEhU5PUm1jYXjXzjJy5vHFj4EveZP39U FOtwIQMsyeHpPeW1KDicwMrpn6Dm/GKVK74HVPym9HJhTpL757K67BA+ dHMzySfMKt0qKyeUVkskZ0Tu6DJKjgB8De9ti6hHNrrh89r3lxg1b7r5 B/o=
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Apr 12 07:13:18 2016
;; MSG SIZE rcvd: 602
O que preciso alterar para obter uma resposta totalmente autenticada, ou seja, o conjunto de bits AD?