{"id":43329,"date":"2011-06-19T11:12:43","date_gmt":"2011-06-19T09:12:43","guid":{"rendered":"https:\/\/blog.wedos.cz\/?p=43329"},"modified":"2020-09-08T11:13:45","modified_gmt":"2020-09-08T09:13:45","slug":"co-je-a-jak-funguje-dnssec","status":"publish","type":"post","link":"https:\/\/blog.wedos.com\/cs\/co-je-a-jak-funguje-dnssec","title":{"rendered":"Co je a jak funguje DNSSEC"},"content":{"rendered":"\n<p>Co je technologie DNSSEC, jak funguje, jak\u00e9 bezpe\u010dnostn\u00ed probl\u00e9my \u0159e\u0161\u00ed a co naopak ne\u0159e\u0161\u00ed, jak\u00e9 jsou jej\u00ed v\u00fdhody a nev\u00fdhody. A je DNSSEC opravdu tak dokonal\u00fd jak jej n\u011bkte\u0159\u00ed prezentuj\u00ed?<\/p>\n\n\n\n<!--more-->\n\n\n\n<h2 class=\"wp-block-heading\">Bezpe\u010dnost protokolu DNS<\/h2>\n\n\n\n<p>Protokol DNS, stejn\u011b jako v\u0161echny ostatn\u00ed protokoly rodiny TCP\/IP, byl v ran\u00e9 dob\u011b Internetu navr\u017een tak, aby byl velmi jednoduch\u00fd a rychl\u00fd. Nebylo do t\u011bchto protokol\u016f zahrnuto t\u00e9m\u011b\u0159 \u017e\u00e1dn\u00e9 zabezpe\u010den\u00ed, proto\u017ee tou dobou nebylo pot\u0159eba. Internet pou\u017e\u00edval jen mal\u00fd okruh lid\u00ed, kte\u0159\u00ed se navz\u00e1jem znali a d\u016fv\u011b\u0159ovali si. Podstatn\u00e1 byla jednoduchost, rychlost a efektivita na tehdy v\u00fdrazn\u011b pomalej\u0161\u00edch link\u00e1ch a m\u00e9n\u011b v\u00fdkonn\u00fdch po\u010d\u00edta\u010d\u00edch. To si s sebou tyto protokoly nesou dodnes, kdy je v\u0161ak celosv\u011btov\u00e1 s\u00ed\u0165 pln\u00e1 lid\u00ed, kte\u0159\u00ed se sna\u017e\u00ed \u0161kodit, a\u0165 je to z osobn\u00edch, finan\u010dn\u00edch, politick\u00fdch \u010di jin\u00fdch d\u016fvod\u016f.<\/p>\n\n\n\n<p>V praxi to znamen\u00e1, \u017ee nap\u0159.&nbsp;<strong>existuj\u00ed zp\u016fsoby, jak m\u016f\u017ee \u00fato\u010dn\u00edk p\u0159i dotazu na p\u0159eklad dom\u00e9nov\u00e9ho n\u00e1zvu podstr\u010dit fale\u0161nou IP adresu<\/strong>&nbsp;a t\u00edm svou ob\u011b\u0165 nasm\u011brovat na podvodn\u00fd server. A tak p\u0159esto\u017ee je URL adresa v prohl\u00ed\u017ee\u010di zad\u00e1na korektn\u011b, u\u017eivatel se ocitne na ciz\u00edch str\u00e1nk\u00e1ch. To je z\u00e1klad pro \u00fasp\u011b\u0161n\u00fd phishing. To je v\u0161ak jen jeden z mnoha p\u0159\u00edklad\u016f, jak lze nezabezpe\u010den\u00e9ho DNS vyu\u017e\u00edt.<\/p>\n\n\n\n<p>R\u016fzn\u00fdm variant\u00e1m podvr\u017een\u00ed \u00fadaj\u016f v DNS se \u0159\u00edk\u00e1&nbsp;<strong>DNS spoofing<\/strong>&nbsp;a&nbsp;<strong>DNS cache poisoning<\/strong>.<\/p>\n\n\n\n<p>Podstata probl\u00e9mu spo\u010d\u00edv\u00e1 v tom, \u017ee kdy\u017e se od DNS serveru na z\u00e1klad\u011b va\u0161eho po\u017eadavku na dom\u00e9nov\u00fd n\u00e1zev dozv\u00edte jakousi IP adresu, nem\u00e1te \u017e\u00e1dnou mo\u017enost si ov\u011b\u0159it, zda je opravdu spr\u00e1vn\u00e1 a zda n\u011bkdo n\u011bco cestou k v\u00e1m nepozm\u011bnil.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Co je DNSSEC<\/h2>\n\n\n\n<p><strong>DNSSEC je technologie vyu\u017e\u00edvaj\u00edc\u00ed elektronick\u00e9ho podpisu k ov\u011b\u0159ov\u00e1n\u00ed p\u016fvodu dat v DNS z\u00e1znamech<\/strong>. To znamen\u00e1, \u017ee u\u017eivatel je schopen si pravost dat z\u00edskan\u00fdch z DNS syst\u00e9mu ov\u011b\u0159it a t\u00edm p\u0159\u00edpadn\u011b odhalit podvrh.<\/p>\n\n\n\n<p>DNSSEC neprov\u00e1d\u00ed \u0161ifrov\u00e1n\u00ed p\u0159en\u00e1\u0161en\u00fdch dat &#8211; data se p\u0159en\u00e1\u0161\u00ed st\u00e1le stejn\u00fdm nezabezpe\u010den\u00fdm zp\u016fsobem, ale&nbsp;<strong>vyu\u017e\u00edv\u00e1 se asymetrick\u00e9 kryptografie pro vytv\u00e1\u0159en\u00ed elektronick\u00fdch podpis\u016f DNS z\u00e1znam\u016f<\/strong>. Tyto podpisy a souvisej\u00edc\u00ed data jsou ukl\u00e1d\u00e1na op\u011bt ve form\u011b DNS z\u00e1znam\u016f. DNSSEC zav\u00e1d\u00ed pro tyto pot\u0159eby n\u011bkolik nov\u00fdch druh\u016f z\u00e1znam\u016f. N\u011bkter\u00e9 obsahuj\u00ed elektronick\u00fd podpis st\u00e1vaj\u00edc\u00edch z\u00e1znam\u016f, jin\u00e9 nesou informace pro ov\u011b\u0159en\u00ed neexistence z\u00e1znam\u016f, kter\u00e9 v z\u00f3n\u011b dom\u00e9ny nejsou.<\/p>\n\n\n\n<p><strong>DNSSEC je roz\u0161\u00ed\u0159en\u00ed st\u00e1vaj\u00edc\u00edho DNS syst\u00e9mu, nikoliv jeho n\u00e1hrada<\/strong>. V\u0161e tedy funguje stejn\u011b jako d\u0159\u00edve, jen vzniklo nav\u00edc n\u011bkolik nov\u00fdch druh\u016f z\u00e1znam\u016f. Z\u00e1le\u017e\u00ed na klientovi, zda nov\u00fdm druh\u016fm z\u00e1znam\u016fm rozum\u00ed, zda je vyu\u017eije a zda provede ov\u011b\u0159en\u00ed \u010di nikoliv. Klient, kter\u00fd DNSSEC nezn\u00e1, akceptuje po\u017eadovan\u00e9 z\u00e1znamy, nov\u00e9 typy z\u00e1znam\u016f ignoruje a neprov\u00e1d\u00ed \u017e\u00e1dnou kontrolu. Modern\u011bj\u0161\u00ed klient v\u0161ak pou\u017eije nov\u00e9 z\u00e1znamy k ov\u011b\u0159en\u00ed t\u011bch ostatn\u00edch a data z\u00edskan\u00e1 ze serveru akceptuje pouze v p\u0159\u00edpad\u011b, \u017ee v\u0161echny elektronick\u00e9 podpisy sed\u00ed. Z toho vypl\u00fdv\u00e1, \u017ee nesta\u010d\u00ed, aby DNSSEC ovl\u00e1daly DNS servery, ale mus\u00ed se aktivn\u011b \u00fa\u010dastnit i klienti. Tedy aby byl cel\u00fd DNS syst\u00e9m naprosto odoln\u00fd proti \u00fatok\u016fm, kter\u00fdm DNSSEC um\u00ed zabr\u00e1nit, mus\u00ed DNSSEC rozum\u011bt a pou\u017e\u00edvat v\u0161echny DNS servery i klienti. Cachovac\u00ed DNS servery samoz\u0159ejm\u011b tak\u00e9 mus\u00ed uchov\u00e1vat a p\u0159ed\u00e1vat d\u00e1l i p\u0159\u00edslu\u0161n\u00e9 DNSSEC z\u00e1znamy.<\/p>\n\n\n\n<p>Je\u0161t\u011b je pot\u0159eba up\u0159esnit, co se zde mysl\u00ed pojmem \u201eklient\u201c. Kontrola z\u00edsk\u00e1van\u00fdch z\u00e1znam\u016f z DNS m\u016f\u017ee prob\u00edhat na n\u011bkolika \u00farovn\u00edch. Kontrolu z\u00e1znam\u016f a jejich podpis\u016f m\u016f\u017ee prov\u00e1d\u011bt p\u0159\u00edmo koncov\u00fd po\u010d\u00edta\u010d. M\u016f\u017ee to v\u0161ak d\u011blat tak\u00e9 cachovac\u00ed DNS server organizace, kter\u00e9mu po\u010d\u00edta\u010de uvnit\u0159 firemn\u00ed s\u00edt\u011b d\u016fv\u011b\u0159uj\u00ed, p\u0159eb\u00edraj\u00ed od n\u011bj DNS z\u00e1znamy a ji\u017e neprov\u00e1d\u00ed jejich kontrolu, d\u00edky tomu nejsou zat\u00ed\u017eeny ov\u011b\u0159ov\u00e1n\u00edm podpis\u016f. Podobn\u011b to m\u016f\u017ee d\u011blat cachovac\u00ed DNS server poskytovatele p\u0159ipojen\u00ed, kter\u00fd na po\u010d\u00edta\u010de sv\u00fdch z\u00e1kazn\u00edk\u016f nepropust\u00ed ned\u016fv\u011bryhodn\u00e1 data.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Co DNSSEC \u0159e\u0161\u00ed<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>ov\u011b\u0159en\u00ed p\u016fvodu z\u00edskan\u00fdch DNS z\u00e1znam\u016f<\/strong>&nbsp;(kontrolou elektronick\u00e9ho podpisu)<\/li><li><strong>z\u00edsk\u00e1n\u00ed d\u016fkazu o neexistenci n\u011bjak\u00e9ho dom\u00e9nov\u00e9ho jm\u00e9na nebo n\u011bjak\u00e9ho jej\u00edho z\u00e1znamu<\/strong><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Co naopak DNSSEC ne\u0159e\u0161\u00ed<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>\u00fatoky na DNS syst\u00e9m klienta, tedy podvr\u017een\u00ed \u00fadaj\u016f na klientsk\u00e9m po\u010d\u00edta\u010di (aplikace nad opera\u010dn\u00edm syst\u00e9mem s DNSSEC ji\u017e nepracuj\u00ed)<\/li><li>zabezpe\u010den\u00ed p\u0159enosov\u00fdch cest protokolu DNS \u2013 v\u0161e nad\u00e1le putuje otev\u0159en\u011b a ve\u0159ejn\u011b, DNS dotazy se mohou odposlouch\u00e1vat (a lze takto zji\u0161\u0165ovat, co kter\u00e9ho klienta zaj\u00edm\u00e1 a kde \u201esurfuje\u201c)<\/li><li>omezen\u00ed p\u0159\u00edstupu k z\u00e1znam\u016fm dom\u00e9ny, autentizaci klient\u016f<\/li><li>\u00fatoky na DNS servery za \u00fa\u010delem jejich odstaven\u00ed, vhodn\u00fd DDoS \u00fatok p\u0159\u00edslu\u0161n\u00fd autoritativn\u00ed DNS server od\u0159\u00edzne od sv\u011bta a k z\u00e1znam\u016fm dom\u00e9ny se v tu dobu nikdo nedostane<\/li><li>podvodn\u00e9 p\u0159esm\u011brov\u00e1n\u00ed \u010di podobn\u00fd \u00fatok na \u00farovni IP adres \u2013 z DNS syst\u00e9mu se sice bezpe\u010dn\u011b dozv\u00edte spr\u00e1vnou IP adresu, na kterou se pot\u0159ebujete spojit, ale DNSSEC nezabr\u00e1n\u00ed tomu, aby v\u00e1s p\u0159i n\u00e1sledn\u00e9 komunikaci s c\u00edlem \u201cman-in-the-middle\u201c nenasm\u011broval jinam<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Ale jsou tu tak\u00e9 n\u011bjak\u00e1 ale&#8230;<\/h2>\n\n\n\n<p>Pozor na kampan\u011b n\u011bkter\u00fdch instituc\u00ed, kter\u00e9 cel\u00fd sv\u011bt p\u0159esv\u011bd\u010duj\u00ed o tom, \u017ee DNSSEC je dokonal\u00e1 technologie, bez kter\u00e9 se ned\u00e1 \u017e\u00edt a bez jej\u00edho zaveden\u00ed se p\u0159estane Zem\u011b to\u010dit kolem Slunce (ob\u010das z toho skute\u010dn\u011b m\u00e1me takov\u00fd pocit). \u017d\u00e1dn\u00e1 dokonal\u00e1 technologie neexistuje a i DNSSEC s sebou nese mnoho komplikac\u00ed a probl\u00e9m\u016f.<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Zaveden\u00ed DNSSEC znamen\u00e1&nbsp;<strong>p\u0159id\u00e1n\u00ed mnoha dal\u0161\u00edch objemn\u00fdch DNS z\u00e1znam\u016f<\/strong>. Velikost z\u00f3nov\u00e9ho souboru dom\u00e9ny vzroste n\u011bkolikan\u00e1sobn\u011b (cca 4x). To znamen\u00e1 v\u011bt\u0161\u00ed n\u00e1roky na \u00falo\u017en\u00fd prostor a v\u011bt\u0161\u00ed datov\u00e9 p\u0159enosy.<br>&nbsp;<\/li><li><strong>Vy\u0161\u0161\u00ed n\u00e1roky na v\u00fdpo\u010detn\u00ed v\u00fdkon<\/strong>&nbsp;&#8211; DNS servery i klienti mus\u00ed nav\u00edc pracovat s elektronick\u00fdmi podpisy (vytv\u00e1\u0159et je, ov\u011b\u0159ovat jejich platnost). To si vy\u017e\u00e1d\u00e1 nemal\u00fd n\u00e1r\u016fst zat\u00ed\u017een\u00ed CPU. A n\u011bkte\u0159\u00ed provozovatel\u00e9 DNS server\u016f se netaj\u00ed t\u00edm, \u017ee budou muset kv\u016fli tomu po\u0159\u00eddit nov\u011bj\u0161\u00ed hardware.<br>&nbsp;<\/li><li><strong>V\u011bt\u0161\u00ed n\u00e1chylnost k poruch\u00e1m<\/strong>&nbsp;&#8211; zaveden\u00ed DNSSEC na DNS serveru vy\u017eaduje v\u011bt\u0161\u00ed odborn\u00e9 znalosti administr\u00e1tor\u016f a program\u00e1tor\u016f, kte\u0159\u00ed mus\u00ed tuto technologii implementovat a spravovat. Jednoduchou lidskou chybou (zapomenut\u00ed na nutnost v\u00fdm\u011bny kl\u00ed\u010d\u016f, chyba v programu) m\u016f\u017ee snadno doj\u00edt k zneplatn\u011bn\u00ed elektronick\u00fdch podpis\u016f, tak\u017ee p\u0159esto\u017ee DNS z\u00e1znamy jsou v po\u0159\u00e1dku a nikdo je nepodvrhnul, budou pova\u017eov\u00e1ny za neplatn\u00e9, a tedy dom\u00e9na nebude fungovat.&nbsp;<br>&nbsp;<\/li><li><strong>Slo\u017eit\u011bj\u0161\u00ed diagnostika probl\u00e9m\u016f<\/strong>&nbsp;&#8211; \u010d\u00edm slo\u017eit\u011bj\u0161\u00ed technologie, t\u00edm komplikovan\u011bj\u0161\u00ed hled\u00e1n\u00ed p\u0159\u00ed\u010din probl\u00e9m\u016f<\/li><\/ol>\n\n\n\n<p>Tak\u017ee se klidn\u011b m\u016f\u017ee st\u00e1t, \u017ee zaveden\u00edm DNSSEC bude doch\u00e1zet k v\u00edce probl\u00e9m\u016fm a nedostupnostem dom\u00e9n ne\u017e kolik probl\u00e9m\u016f zp\u016fsob\u00ed p\u0159\u00edpadn\u00ed \u00fato\u010dn\u00edci p\u0159i nepou\u017eit\u00ed t\u00e9to technologie.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Alternativy k DNSSEC<\/h2>\n\n\n\n<p>D\u00e1le je pot\u0159eba si d\u00e1t pozor na tvrzen\u00ed, \u017ee DNSSEC je jedin\u00e1 technologie, kter\u00e1 dok\u00e1\u017ee ochr\u00e1nit proti podvr\u017een\u00ed \u00fadaj\u016f v DNS. Nen\u00ed to pravda. Nap\u0159.&nbsp;<strong>SSL (Secure Socket Layer)<\/strong>&nbsp;zde existuje ji\u017e velmi d\u00e1vno a dok\u00e1\u017ee to sam\u00e9 v\u010detn\u011b ochrany proti p\u0159esm\u011brov\u00e1n\u00ed komunikace na ciz\u00ed server (proto\u017ee jen ten prav\u00fd server je schopen prok\u00e1zat se p\u0159\u00edslu\u0161n\u00fdm soukrom\u00fdm kl\u00ed\u010dem). A jako bonus celou komunikaci mezi koncov\u00fdm klientem a serverem za\u0161ifruje, tak\u017ee ani nelze nic odposlechnout. Nap\u0159\u00edklad HTTPS &#8211; zabezpe\u010den\u00e1 komunikace p\u0159es HTTP protokol.<\/p>\n\n\n\n<p>Na druhou stranu je pravda, \u017ee SSL nedok\u00e1\u017ee zajistit d\u016fkaz o neexistenci n\u011bjak\u00e9 dom\u00e9ny \u010di DNS z\u00e1znamu. To zvl\u00e1dne jen DNSSEC.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">My a DNSSEC<\/h2>\n\n\n\n<p>Technologii DNSSEC nyn\u00ed nab\u00edz\u00edme v&nbsp;<strong>testovac\u00edm provozu u .CZ dom\u00e9n<\/strong>. \u010casem ji nab\u00eddneme i u dal\u0161\u00edch. Nebudeme ji v\u0161ak z\u00e1kazn\u00edk\u016fm vnucovat. Kdo m\u00e1 z\u00e1jem si ji aktivovat, m\u00e1 mo\u017enost. Nechyst\u00e1me se ji automaticky zap\u00ednat u v\u0161ech dom\u00e9n v\u0161ech na\u0161ich z\u00e1kazn\u00edk\u016f, alespo\u0148 prozat\u00edm. Je pot\u0159eba tuto technologii nechat trochu uzr\u00e1t a vychytat p\u0159\u00edpadn\u00e9 nedostatky.<\/p>\n\n\n\n<p>Je nutn\u00e9 \u0159\u00edci, \u017ee pro koncov\u00e9 u\u017eivatele a na\u0161e z\u00e1kazn\u00edky se s DNSSEC nic nem\u011bn\u00ed. O v\u0161e se postar\u00e1me my, z\u00e1kazn\u00edci nemus\u00ed d\u011blat nic nav\u00edc ani nemus\u00ed t\u00e9to technologii podrobn\u011b rozum\u011bt. Pro n\u011b je v\u0161e transparentn\u00ed.<\/p>\n\n\n\n<p>Do na\u0161\u00ed\u00a0<a href=\"https:\/\/kb.wedos.com\/\" target=\"_blank\" rel=\"noopener\">znalostn\u00ed b\u00e1ze<\/a>\u00a0\u010dasem dopln\u00edme podrobn\u011bj\u0161\u00ed technick\u00e9 informace o DNSSEC.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Co je technologie DNSSEC, jak funguje, jak\u00e9 bezpe\u010dnostn\u00ed probl\u00e9my \u0159e\u0161\u00ed a co naopak ne\u0159e\u0161\u00ed, jak\u00e9 jsou jej\u00ed v\u00fdhody a nev\u00fdhody. A je DNSSEC opravdu tak dokonal\u00fd jak jej n\u011bkte\u0159\u00ed prezentuj\u00ed?<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[112],"tags":[],"class_list":["post-43329","post","type-post","status-publish","format-standard","hentry","category-bezpecnost"],"_links":{"self":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/43329","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/comments?post=43329"}],"version-history":[{"count":1,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/43329\/revisions"}],"predecessor-version":[{"id":43334,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/43329\/revisions\/43334"}],"wp:attachment":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/media?parent=43329"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/categories?post=43329"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/tags?post=43329"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}