DNS and Security DNS and Security DNS and Security DNS and - - PowerPoint PPT Presentation

▶
dns and security dns and security dns and security dns
SMART_READER_LITE
LIVE PREVIEW

DNS and Security DNS and Security DNS and Security DNS and - - PowerPoint PPT Presentation

Dec 03, 2022 132 likes •864 views

DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and

slide-1
SLIDE 1

DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security

Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto RMLL Security Track July 5th, 2016

slide-2
SLIDE 2

whois whois whois whois whois whois whois whois whois whois whois whois whois whois whois whois whois

Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto

  • Sysadmin at inuits.eu

Sysadmin at inuits.eu Sysadmin at inuits.eu Sysadmin at inuits.eu Sysadmin at inuits.eu Sysadmin at inuits.eu Sysadmin at inuits.eu Sysadmin at inuits.eu Sysadmin at inuits.eu Sysadmin at inuits.eu Sysadmin at inuits.eu Sysadmin at inuits.eu Sysadmin at inuits.eu Sysadmin at inuits.eu Sysadmin at inuits.eu Sysadmin at inuits.eu Sysadmin at inuits.eu

  • From small to large scale orgs

From small to large scale orgs From small to large scale orgs From small to large scale orgs From small to large scale orgs From small to large scale orgs From small to large scale orgs From small to large scale orgs From small to large scale orgs From small to large scale orgs From small to large scale orgs From small to large scale orgs From small to large scale orgs From small to large scale orgs From small to large scale orgs From small to large scale orgs From small to large scale orgs

  • Automation & Monitoring

Automation & Monitoring Automation & Monitoring Automation & Monitoring Automation & Monitoring Automation & Monitoring Automation & Monitoring Automation & Monitoring Automation & Monitoring Automation & Monitoring Automation & Monitoring Automation & Monitoring Automation & Monitoring Automation & Monitoring Automation & Monitoring Automation & Monitoring Automation & Monitoring

  • @roidelapluie

@roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie on irc/twitter/github

  • n irc/twitter/github
  • n irc/twitter/github
  • n irc/twitter/github
  • n irc/twitter/github
  • n irc/twitter/github
  • n irc/twitter/github
  • n irc/twitter/github
  • n irc/twitter/github
  • n irc/twitter/github
  • n irc/twitter/github
  • n irc/twitter/github
  • n irc/twitter/github
  • n irc/twitter/github
  • n irc/twitter/github
  • n irc/twitter/github
  • n irc/twitter/github
slide-3
SLIDE 3

inuits.eu

slide-4
SLIDE 4

DNS DNS DNS DNS DNS DNS DNS DNS DNS DNS DNS DNS DNS DNS DNS DNS DNS

slide-5
SLIDE 5

What is DNS? What is DNS? What is DNS? What is DNS? What is DNS? What is DNS? What is DNS? What is DNS? What is DNS? What is DNS? What is DNS? What is DNS? What is DNS? What is DNS? What is DNS? What is DNS? What is DNS?

  • T

T T T T T T T T T T T T T T T TL;DR Translates domain name to IP

  • I

I I I I I I I I I I I I I I I In facto, stores much more data than IP

slide-6
SLIDE 6

How it works How it works How it works How it works How it works How it works How it works How it works How it works How it works How it works How it works How it works How it works How it works How it works How it works

Licensed under a Creative Commons Attribution-ShareAlike 2.0 License https://www.flickr.com/photos/frans16611/6139595092

slide-7
SLIDE 7

Licensed under a Creative Commons Attribution-ShareAlike 2.0 License Inspired by @jpmens - Icons by http://jcartier.net/spip.php?aticle39

slide-8
SLIDE 8

Licensed under a Creative Commons Attribution-ShareAlike 2.0 License Inspired by @jpmens - Icons by http://jcartier.net/spip.php?aticle39

slide-9
SLIDE 9

Licensed under a Creative Commons Attribution-ShareAlike 2.0 License Inspired by @jpmens - Icons by http://jcartier.net/spip.php?aticle39

slide-10
SLIDE 10

Licensed under a Creative Commons Attribution-ShareAlike 2.0 License Inspired by @jpmens - Icons by http://jcartier.net/spip.php?aticle39

slide-11
SLIDE 11

Licensed under a Creative Commons Attribution-ShareAlike 2.0 License Inspired by @jpmens - Icons by http://jcartier.net/spip.php?aticle39

slide-12
SLIDE 12

DNS is mission-critical DNS is mission-critical DNS is mission-critical DNS is mission-critical DNS is mission-critical DNS is mission-critical DNS is mission-critical DNS is mission-critical DNS is mission-critical DNS is mission-critical DNS is mission-critical DNS is mission-critical DNS is mission-critical DNS is mission-critical DNS is mission-critical DNS is mission-critical DNS is mission-critical

  • H

H H H H H H H H H H H H H H H Holds IP addresses

  • H

H H H H H H H H H H H H H H H Holds service definitions

  • H

H H H H H H H H H H H H H H H Holds hostnames, TXT records

slide-13
SLIDE 13

DNS practices DNS practices DNS practices DNS practices DNS practices DNS practices DNS practices DNS practices DNS practices DNS practices DNS practices DNS practices DNS practices DNS practices DNS practices DNS practices DNS practices

  • D

D D D D D D D D D D D D D D D Do not mix Authoritative and Recursive servers

  • M

M M M M M M M M M M M M M M M Mix your DNS server `brand'

  • H

H H H H H H H H H H H H H H H Hide your DNS masters

  • D

D D D D D D D D D D D D D D D Do not invent new TLD

slide-14
SLIDE 14

Data stored in DNS Data stored in DNS Data stored in DNS Data stored in DNS Data stored in DNS Data stored in DNS Data stored in DNS Data stored in DNS Data stored in DNS Data stored in DNS Data stored in DNS Data stored in DNS Data stored in DNS Data stored in DNS Data stored in DNS Data stored in DNS Data stored in DNS

  • A

A A A A A A A A A A A A A A A A records: IP addresses

  • C

C C C C C C C C C C C C C C C CNAME: Cannonical names

  • S

S S S S S S S S S S S S S S S SRV: Service record

  • M

M M M M M M M M M M M M M M M MX: Mail servers

  • T

T T T T T T T T T T T T T T T TXT: Text record

slide-15
SLIDE 15

SRV records SRV records SRV records SRV records SRV records SRV records SRV records SRV records SRV records SRV records SRV records SRV records SRV records SRV records SRV records SRV records SRV records

_xmpp−client._tcp.inuits.eu. IN SRV 0 5 5222 xmpp.inuits.eu.

slide-16
SLIDE 16

TXT Records TXT Records TXT Records TXT Records TXT Records TXT Records TXT Records TXT Records TXT Records TXT Records TXT Records TXT Records TXT Records TXT Records TXT Records TXT Records TXT Records

  • S

S S S S S S S S S S S S S S S SPF record: Sender Policy Framework

  • D

D D D D D D D D D D D D D D D DKIM

  • K

K K K K K K K K K K K K K K K Keybase.io

  • L

L L L L L L L L L L L L L L L Let's Encrypt DNS challenge

slide-17
SLIDE 17

Not secure by design Not secure by design Not secure by design Not secure by design Not secure by design Not secure by design Not secure by design Not secure by design Not secure by design Not secure by design Not secure by design Not secure by design Not secure by design Not secure by design Not secure by design Not secure by design Not secure by design

  • 1

1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1983

  • D

D D D D D D D D D D D D D D D Designed for scale, not security

  • E

E E E E E E E E E E E E E E E Early 2000: birth of DNSSec

slide-18
SLIDE 18

DNSSec DNSSec DNSSec DNSSec DNSSec DNSSec DNSSec DNSSec DNSSec DNSSec DNSSec DNSSec DNSSec DNSSec DNSSec DNSSec DNSSec

  • 2

2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2000's DNSSec RFC

  • D

D D D D D D D D D D D D D D D DNSSec hit DNS root in 2010

  • M

M M M M M M M M M M M M M M M Multiple iteration of RFC

slide-19
SLIDE 19

The Domain Name System Security Extensions (DNSSEC) add data origin authentication and data integrity to the Domain Name System. RFC 4033

slide-20
SLIDE 20

What is DNS Sec? What is DNS Sec? What is DNS Sec? What is DNS Sec? What is DNS Sec? What is DNS Sec? What is DNS Sec? What is DNS Sec? What is DNS Sec? What is DNS Sec? What is DNS Sec? What is DNS Sec? What is DNS Sec? What is DNS Sec? What is DNS Sec? What is DNS Sec? What is DNS Sec?

  • P

P P P P P P P P P P P P P P P Proof of origin and integrity

  • Z

Z Z Z Z Z Z Z Z Z Z Z Z Z Z Z Zones and records signing

  • P

P P P P P P P P P P P P P P P Proof of non-existence

slide-21
SLIDE 21

Two types of keys Two types of keys Two types of keys Two types of keys Two types of keys Two types of keys Two types of keys Two types of keys Two types of keys Two types of keys Two types of keys Two types of keys Two types of keys Two types of keys Two types of keys Two types of keys Two types of keys

  • Z

Z Z Z Z Z Z Z Z Z Z Z Z Z Z Z ZSK: Zone Signing Key

  • K

K K K K K K K K K K K K K K K KSK: Key Signing Key

slide-22
SLIDE 22

Zone Signing key Zone Signing key Zone Signing key Zone Signing key Zone Signing key Zone Signing key Zone Signing key Zone Signing key Zone Signing key Zone Signing key Zone Signing key Zone Signing key Zone Signing key Zone Signing key Zone Signing key Zone Signing key Zone Signing key

  • P

P P P P P P P P P P P P P P P Private/Public key pair

  • S

S S S S S S S S S S S S S S S Sign the Records

  • e

e e e e e e e e e e e e e e e e.g sign the A records, the MX records …

  • R

R R R R R R R R R R R R R R R Rolled out frequently

slide-23
SLIDE 23

Key Signing Key Key Signing Key Key Signing Key Key Signing Key Key Signing Key Key Signing Key Key Signing Key Key Signing Key Key Signing Key Key Signing Key Key Signing Key Key Signing Key Key Signing Key Key Signing Key Key Signing Key Key Signing Key Key Signing Key

  • P

P P P P P P P P P P P P P P P Private/Public key pair

  • S

S S S S S S S S S S S S S S S Sign the ZSK

  • D

D D D D D D D D D D D D D D D Designed to be stronger than the ZSK

  • I

I I I I I I I I I I I I I I I Its fingerprint is stored in parent zone

slide-24
SLIDE 24

DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types

  • R

R R R R R R R R R R R R R R R RRSIG: Signature

  • D

D D D D D D D D D D D D D D D DNSKEY: Public key

  • D

D D D D D D D D D D D D D D D DS: Hash of a DNSKEY (parent zone)

slide-25
SLIDE 25

DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types DNS Records types

  • N

N N N N N N N N N N N N N N N NSEC: Next secure

  • R

R R R R R R R R R R R R R R R Returns the next secure entry

  • R

R R R R R R R R R R R R R R R Returned when next secure is not found

  • N

N N N N N N N N N N N N N N N NSEC/NSEC3 records are signed

  • N

N N N N N N N N N N N N N N N NSEC3 prevents zone walking

slide-26
SLIDE 26

In Practice In Practice In Practice In Practice In Practice In Practice In Practice In Practice In Practice In Practice In Practice In Practice In Practice In Practice In Practice In Practice In Practice

slide-27
SLIDE 27

Bind Bind Bind Bind Bind Bind Bind Bind Bind Bind Bind Bind Bind Bind Bind Bind Bind

  • R

R R R R R R R R R R R R R R R Reference DNS Server

  • D

D D D D D D D D D D D D D D D Developed by the Internet Systems Consortium

  • C

C C C C C C C C C C C C C C C Current version: bind9

  • b

b b b b b b b b b b b b b b b bind10 project is abandoned

slide-28
SLIDE 28

Bind features Bind features Bind features Bind features Bind features Bind features Bind features Bind features Bind features Bind features Bind features Bind features Bind features Bind features Bind features Bind features Bind features

  • S

S S S S S S S S S S S S S S S Supports everything

  • R

R R R R R R R R R R R R R R R Recurive, Authoritative

  • D

D D D D D D D D D D D D D D D Dynamic updates

  • D

D D D D D D D D D D D D D D D DNSSec

slide-29
SLIDE 29

Bind and DNSSec Bind and DNSSec Bind and DNSSec Bind and DNSSec Bind and DNSSec Bind and DNSSec Bind and DNSSec Bind and DNSSec Bind and DNSSec Bind and DNSSec Bind and DNSSec Bind and DNSSec Bind and DNSSec Bind and DNSSec Bind and DNSSec Bind and DNSSec Bind and DNSSec

  • F

F F F F F F F F F F F F F F F Full support + NSEC3

  • M

M M M M M M M M M M M M M M M Manual signing

  • A

A A A A A A A A A A A A A A A Automated signing

  • D

D D D D D D D D D D D D D D D DNSSec and dynamic zones

slide-30
SLIDE 30

Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys

mkdir /etc/bind/keys cd /etc/bind/keys dnssec−keygen rmll.example dnssec−keygen −f KSK rmll.example

slide-31
SLIDE 31

Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys Generating keys

dnssec−keygen −a NSEC3RSASHA1 −b 2048 rmll .example dnssec−keygen −a NSEC3RSASHA1 −b 4096 −f KSK rmll.example

slide-32
SLIDE 32

Generating DS keys Generating DS keys Generating DS keys Generating DS keys Generating DS keys Generating DS keys Generating DS keys Generating DS keys Generating DS keys Generating DS keys Generating DS keys Generating DS keys Generating DS keys Generating DS keys Generating DS keys Generating DS keys Generating DS keys

dnssec−dsfromkey −f /var/bind/rmll. example −K /etc/bind/keys/ rmll.example rmll.example. IN DS 18025 8 1 E223065EE5EE66F08CA1C89D8 rmll.example. IN DS 18025 8 2 522 D8EA3287FFF41186169A30

slide-33
SLIDE 33

Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind Enable DNSSec in bind

  • ptions {

dnssec−enable yes; dnssec−validation yes; }

slide-34
SLIDE 34

Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone

Manually signed Manually signed Manually signed Manually signed Manually signed Manually signed Manually signed Manually signed Manually signed Manually signed Manually signed Manually signed Manually signed Manually signed Manually signed Manually signed Manually signed

zone "rmll.example" IN { type master; file "rmll.example.zone.signed"; };

slide-35
SLIDE 35

Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone Enable DNSSec for a zone

Auto Signing Auto Signing Auto Signing Auto Signing Auto Signing Auto Signing Auto Signing Auto Signing Auto Signing Auto Signing Auto Signing Auto Signing Auto Signing Auto Signing Auto Signing Auto Signing Auto Signing

zone "rmll.example" IN { type master; file "rmll.example.zone"; key−directory "/etc/bind/keys"; auto−dnssec maintain; inline−signing yes; };

slide-36
SLIDE 36

Manually Sign a zone Manually Sign a zone Manually Sign a zone Manually Sign a zone Manually Sign a zone Manually Sign a zone Manually Sign a zone Manually Sign a zone Manually Sign a zone Manually Sign a zone Manually Sign a zone Manually Sign a zone Manually Sign a zone Manually Sign a zone Manually Sign a zone Manually Sign a zone Manually Sign a zone

dnssec−signzone −S −o rmll.example −K /etc /bind/keys/ /var/bind/master/rmll. example.zone

  • Creates a .signed zone file

Creates a .signed zone file Creates a .signed zone file Creates a .signed zone file Creates a .signed zone file Creates a .signed zone file Creates a .signed zone file Creates a .signed zone file Creates a .signed zone file Creates a .signed zone file Creates a .signed zone file Creates a .signed zone file Creates a .signed zone file Creates a .signed zone file Creates a .signed zone file Creates a .signed zone file Creates a .signed zone file

slide-37
SLIDE 37

DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE

slide-38
SLIDE 38

DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE DANE

  • D

D D D D D D D D D D D D D D D DNS-based Authentication of Named Entities

  • N

N N N N N N N N N N N N N N N New record types to store public keys hashes

  • I

I I I I I I I I I I I I I I I Independant from DNSSec (!)

slide-39
SLIDE 39

TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records

  • H

H H H H H H H H H H H H H H H Hash the fingerprint of a TLS key

  • "

" " " " " " " " " " " " " " " "Replacement" for the CA (https)

  • N

N N N N N N N N N N N N N N N Not implemented natively in browsers

  • I

I I I I I I I I I I I I I I I Implemented in IRC clients (irssi)

slide-40
SLIDE 40

TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records TLSA records

_443._tcp IN TLSA 3 0 1 2 bfa3214fda53315b140e65fe66 _443._tcp.www IN TLSA 3 0 1 2 bfa3214fda53315b140e65 _6697._tcp.irc IN TLSA 3 0 1 2 bfa3214fda53315b140e6

slide-41
SLIDE 41

Generating a hash Generating a hash Generating a hash Generating a hash Generating a hash Generating a hash Generating a hash Generating a hash Generating a hash Generating a hash Generating a hash Generating a hash Generating a hash Generating a hash Generating a hash Generating a hash Generating a hash

  • penssl x509 −in cert.pem −outform DER |
  • penssl sha256
slide-42
SLIDE 42

SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH

slide-43
SLIDE 43

TOFU TOFU TOFU TOFU TOFU TOFU TOFU TOFU TOFU TOFU TOFU TOFU TOFU TOFU TOFU TOFU TOFU

  • T

T T T T T T T T T T T T T T T Trust on first use

  • W

W W W W W W W W W W W W W W W Works on slowly moving env's

  • N

N N N N N N N N N N N N N N N Nowadays we populate new hosts all the time

  • N

N N N N N N N N N N N N N N N Nowadays we rebuild existing hosts

slide-44
SLIDE 44

SSHFP records SSHFP records SSHFP records SSHFP records SSHFP records SSHFP records SSHFP records SSHFP records SSHFP records SSHFP records SSHFP records SSHFP records SSHFP records SSHFP records SSHFP records SSHFP records SSHFP records

  • H

H H H H H H H H H H H H H H H Hash the fingerprint of a SSH server

  • I

I I I I I I I I I I I I I I I Implemented in OpenSSH

  • U

U U U U U U U U U U U U U U U Uses DNS to recognize SSH key

slide-45
SLIDE 45

IN SSHFP 1 1 e0fd9112d2fc6974597fe8968665ad6b420c IN SSHFP 1 2 9 de5bc066a898733420bcfaae8f43e80e532 IN SSHFP 2 1 223 e89447a53a3178be02fee6fdd5b44228a IN SSHFP 2 2 2644 fcbd2a1b179091a195207e395d009b16

slide-46
SLIDE 46

VerifyHostKeyDNS no VerifyHostKeyDNS yes VerifyHostKeyDNS ask

slide-47
SLIDE 47

$ ssh −o VerifyHostKeyDNS=yes rmll.example The authenticity of host 'rmll.example (1.2.3.4)' can't be established. ECDSA key fingerprint is SHA256: f8zwQD3RU62PXgwCw5WRk2OIyVY. Matching host key fingerprint found in DNS Are you sure you want to continue?

slide-48
SLIDE 48

Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields Populating SSHFP fields

  • W

W W W W W W W W W W W W W W W What if we have a single source of truth?

  • S

S S S S S S S S S S S S S S S Something that can scale, and be quick enough?

slide-49
SLIDE 49

Config Management Config Management Config Management Config Management Config Management Config Management Config Management Config Management Config Management Config Management Config Management Config Management Config Management Config Management Config Management Config Management Config Management

  • Q

Q Q Q Q Q Q Q Q Q Q Q Q Q Q Q Quickly moving env often use Cfgmgmt Tools

  • T

T T T T T T T T T T T T T T T They know the env, store data

  • W

W W W W W W W W W W W W W W W We use Puppet+The foreman

slide-50
SLIDE 50

Puppet Puppet Puppet Puppet Puppet Puppet Puppet Puppet Puppet Puppet Puppet Puppet Puppet Puppet Puppet Puppet Puppet

  • A

A A A A A A A A A A A A A A A A Config Management Tool

  • D

D D D D D D D D D D D D D D D Declarative

  • E

E E E E E E E E E E E E E E E Enforces a desired state

slide-51
SLIDE 51

Puppet Facts Puppet Facts Puppet Facts Puppet Facts Puppet Facts Puppet Facts Puppet Facts Puppet Facts Puppet Facts Puppet Facts Puppet Facts Puppet Facts Puppet Facts Puppet Facts Puppet Facts Puppet Facts Puppet Facts

  • V

V V V V V V V V V V V V V V V Values collected on the host

  • O

O O O O O O O O O O O O O O O OS version, Uptime, kernel

  • S

S S S S S S S S S S S S S S S SSH fingerprints

  • S

S S S S S S S S S S S S S S S Sent back to master

slide-52
SLIDE 52

facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp

  • h

h h h h h h h h h h h h h h h https://github.com/jpmens/facts2sshfp

  • P

P P P P P P P P P P P P P P P Python script

  • R

R R R R R R R R R R R R R R R Read facts yaml files

  • C

C C C C C C C C C C C C C C C Converts Puppet facts to SSHFP records

  • U

U U U U U U U U U U U U U U U Uses Puppet as single source of truth

  • f

f f f f f f f f f f f f f f f facts2sshfp.py -T nsupdate.template -D a.aa.

  • O

O O O O O O O O O O O O O O O Output to templates, nsupdate commands…

slide-53
SLIDE 53

The Foreman

Provisioning Configuration Monitoring

Reporting

slide-54
SLIDE 54

The Foreman

Provisioning Configuration Monitoring

Reporting

slide-55
SLIDE 55

The Foreman

Provisioning Configuration Monitoring

Reporting

slide-56
SLIDE 56

The Foreman

Provisioning Configuration Monitoring

Reporting

slide-57
SLIDE 57

The Foreman

Provisioning Configuration Monitoring

Reporting

slide-58
SLIDE 58
slide-59
SLIDE 59
slide-60
SLIDE 60
slide-61
SLIDE 61

Foreman Proxies Foreman Proxies Foreman Proxies Foreman Proxies Foreman Proxies Foreman Proxies Foreman Proxies Foreman Proxies Foreman Proxies Foreman Proxies Foreman Proxies Foreman Proxies Foreman Proxies Foreman Proxies Foreman Proxies Foreman Proxies Foreman Proxies

  • F

F F F F F F F F F F F F F F F Foreman works with a GUI + Proxies

  • D

D D D D D D D D D D D D D D D DHCP proxy, Puppet Proxy, DNS proxy…

  • D

D D D D D D D D D D D D D D D DNS Proxy is pluggable: bind9, powerdns…

slide-62
SLIDE 62

Foreman is great Foreman is great Foreman is great Foreman is great Foreman is great Foreman is great Foreman is great Foreman is great Foreman is great Foreman is great Foreman is great Foreman is great Foreman is great Foreman is great Foreman is great Foreman is great Foreman is great

  • O

O O O O O O O O O O O O O O O Open Source

  • B

B B B B B B B B B B B B B B B Backed by Red Hat

  • T

T T T T T T T T T T T T T T T The main brick behind Red Hat Satellite 6

  • P

P P P P P P P P P P P P P P P Provides a REST API

slide-63
SLIDE 63

Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host Building a (libvirt) host

  • C

C C C C C C C C C C C C C C C Create/update DNS entries

  • C

C C C C C C C C C C C C C C C Create/update DHCP entries

  • C

C C C C C C C C C C C C C C C Create the VM in libvirt

  • B

B B B B B B B B B B B B B B B Boot the VM

  • S

S S S S S S S S S S S S S S S Serve a kickstart

  • R

R R R R R R R R R R R R R R R Run Puppet

slide-64
SLIDE 64

The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy The Foreman - Puppet proxy

  • P

P P P P P P P P P P P P P P P Puppet Collects and save Facts on the machines

  • I

I I I I I I I I I I I I I I I It can send it back to the Foreman

  • F

F F F F F F F F F F F F F F F Foreman can graph them, query them…

slide-65
SLIDE 65

facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp facts2sshfp

  • h

h h h h h h h h h h h h h h h https://github.com/jpmens/facts2sshfp

  • f

f f f f f f f f f f f f f f f facts2sshfp.py -T nsupdate.template

  • -foreman-url=https://foreman.example -D

a.aa.

slide-66
SLIDE 66

Conclusion Conclusion Conclusion Conclusion Conclusion Conclusion Conclusion Conclusion Conclusion Conclusion Conclusion Conclusion Conclusion Conclusion Conclusion Conclusion Conclusion

Licensed under a Creative Commons Attribution 2.0 License https://www.flickr.com/photos/haslamdigital/17191280202/sizes/h/

slide-67
SLIDE 67

DNS rocks DNS rocks DNS rocks DNS rocks DNS rocks DNS rocks DNS rocks DNS rocks DNS rocks DNS rocks DNS rocks DNS rocks DNS rocks DNS rocks DNS rocks DNS rocks DNS rocks

  • N

N N N N N N N N N N N N N N N Needed everywhere

  • D

D D D D D D D D D D D D D D D Distributed

  • C

C C C C C C C C C C C C C C C Contains lots of data

  • M

M M M M M M M M M M M M M M M Makes our life easier

slide-68
SLIDE 68

DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement DNSSec is easy to implement

  • A

A A A A A A A A A A A A A A A Automation is key

  • I

I I I I I I I I I I I I I I I Implemented in most of the tools

  • A

A A A A A A A A A A A A A A A And most of the DNS servers

slide-69
SLIDE 69

DANE adds more security DANE adds more security DANE adds more security DANE adds more security DANE adds more security DANE adds more security DANE adds more security DANE adds more security DANE adds more security DANE adds more security DANE adds more security DANE adds more security DANE adds more security DANE adds more security DANE adds more security DANE adds more security DANE adds more security

  • S

S S S S S S S S S S S S S S S SSH fingerprint

  • I

I I I I I I I I I I I I I I I IRC, SMTP certificates hashes

  • E

E E E E E E E E E E E E E E E Existing client-side implementations

slide-70
SLIDE 70

DNSSec+DANE DNSSec+DANE DNSSec+DANE DNSSec+DANE DNSSec+DANE DNSSec+DANE DNSSec+DANE DNSSec+DANE DNSSec+DANE DNSSec+DANE DNSSec+DANE DNSSec+DANE DNSSec+DANE DNSSec+DANE DNSSec+DANE DNSSec+DANE DNSSec+DANE

  • D

D D D D D D D D D D D D D D D DNSSec and Dane are more useful together

  • M

M M M M M M M M M M M M M M M Make sure your resolver supports DNSsec!

  • T

T T T T T T T T T T T T T T T The power to check certificates without CA

slide-71
SLIDE 71

Contact Contact Contact Contact Contact Contact Contact Contact Contact Contact Contact Contact Contact Contact Contact Contact Contact

Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto julien@inuits.eu julien@inuits.eu julien@inuits.eu julien@inuits.eu julien@inuits.eu julien@inuits.eu julien@inuits.eu julien@inuits.eu julien@inuits.eu julien@inuits.eu julien@inuits.eu julien@inuits.eu julien@inuits.eu julien@inuits.eu julien@inuits.eu julien@inuits.eu julien@inuits.eu @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie

inuits inuits inuits inuits inuits inuits inuits inuits inuits inuits inuits inuits inuits inuits inuits inuits inuits

https://inuits.eu https://inuits.eu https://inuits.eu https://inuits.eu https://inuits.eu https://inuits.eu https://inuits.eu https://inuits.eu https://inuits.eu https://inuits.eu https://inuits.eu https://inuits.eu https://inuits.eu https://inuits.eu https://inuits.eu https://inuits.eu https://inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu info@inuits.eu +32 473 441 636 +32 473 441 636 +32 473 441 636 +32 473 441 636 +32 473 441 636 +32 473 441 636 +32 473 441 636 +32 473 441 636 +32 473 441 636 +32 473 441 636 +32 473 441 636 +32 473 441 636 +32 473 441 636 +32 473 441 636 +32 473 441 636 +32 473 441 636 +32 473 441 636