Making real use of DNSSEC: DANE

By now we can safely say that DNSSEC as a standard is here to stay. It may not be pretty or completely practical, but it is possible to implement it relatively easily. DNSSEC provides a little bit more assurance on the integrity of the DNS query results. This extra assurance does enable some other interesting applications, to increase the integrity of other systems. This is done through the standard called DANE: DNS-based Authentication of Named Entities. In this post I’ll walk through a couple of examples.

Update 23/7/2015:  Added email TLSA record instructions

Update 23/7/2015:  Corrected email TLSA record instructions

Continue reading

[Dutch] Afsluiting WOB verzoek Jeugdzorg

Op 3 december 2014 heb ik de uiteindelijke beslissing gekregen op mijn bezwaar. Dit besluit heeft erg lang op zich laten wachten nadat we op 10 september geprobeerd hebben het informeel op te lossen. De gemeente heeft haar besluit nu uitvoerig gedocumenteerd.

Continue reading

Beveiliging van Jeugdzorg ICT Infrastructuur

Het begon allemaal met een startknop. Niet veel later was er een dikke vinger. Na een jaar stond ik voor het eerst voor de rechter en uiteindelijk kreeg ik na veel aandringen te horen dat ik niets zou krijgen. Niet omdat het niet mocht, maar omdat er niets te halen viel. Maar daarmee kan ik wel laten zien dat de gemeente geen interesse lijkt te tonen voor de beveiliging van een belangrijke ICT infrastructuur. Een verslag van mijn eerste WOB-verzoek.

In oktober 2013 ging ik met mijn jongste dochter naar het consultatiebureau. De kinderarts zocht wat dingen op en ik keek mee op het scherm. Tot mijn schrik zag ik daar een grijze startknop. Zo een die hoort bij een uitgefaseerde Windows versie. Maar op die computer staat heel veel gevoelige informatie over mij, mijn dochter, maar ook over andere ouders en kinderen in de buurt, en verbonden met computers met gegevens uit heel Utrecht.

Continue reading

DNSSEC Key Rollovers Explained

In an earlier post I explained the idea of DNSSEC how to generate keys and sign your DNS zone. In this post I will walk you through the rollover methods as described in RFC 6781. You should understand the rollover process so that you can securely run your zone. This way you can  replace the key in a secure manner when necessary, without service interruptions.

In the earlier post I explained that there are two sets of keys for most DNSSEC signed zones, a Key Signing Key (KSK) and a Zone Signing Key (ZSK). The ZSK is used most often, and should be replaced about yearly, and is also the easiest to replace. Once that process is explained, it is easier to understand how to rollover a KSK also. Continue reading

Going down an elliptically curved rabbit hole

Yesterday I posted a guide to securing your nginx server with some good SSL settings. As I mentioned in that post, I am eager to get rid of RSA entirely, because it is going to be broken at some point in the not so distant future. So I spent part of the day researching the possibility of using Elliptic Curve Cryptography for my site, below are some of my findings.

Continue reading

Securing your site with nginx

This week in the Netherlands the news hit again that some secure websites where vulnerable to a downgrade attack. This attack is not new, but for the average user it is hard to detect. You have to be careful that you see the lock when you are entering your credentials.

Fortunately, most new web servers and browsers have a setting for it, called HTTPs Strict Transport Security (HSTS). With that feature enabled, if your browser has ever contacted a website over a secure link (HTTPS), then it will not allow a downgrade to plain HTTP for that host. This of course means that you are more secure, at least as long as you watch out for certificate warnings. I use the nginx webserver, and use some other things for security, which I’ll share with you below. The SSLLabs test will give this configuration an A+ currently.

Edit 26/3: @okoeroo gave me a better list of ciphers which scores even higher with SSLabs:

    ssl_ciphers  ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:ECDH-RSA-AES256-SHA:TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:TLS_DHE_RSA_WITH_AES_128_CBC_SHA:CAMELLIA256-SHA:AES256-SHA;

Continue reading

Playing with TinySSH on FreeBSD and OS X

TinySSH is a new small SSH server using state-of-the-art encryption using the TweetNaCL cryptographic library. It piqued my interest as it claims to be an easily configured and auditable SSH server with new cryptographic primitives and has no dependency on OpenSSL. Its development target is Debian, but since it has limited dependencies it is not hard to get it to run on other systems. This post has some notes on how to get things up and running on a FreeBSD server and an OS X client.

Continue reading

Trying out Keybase.io

I’ve joined Keybase this week: keybase.io/jeroenh. This is a new service which hosts a directory of public keys together with a verifiable list of usernames.

Continue reading

Making DNSSEC More Accessible

I have previously written about DNSSECs “failure”. I tried to draw attention to the absence of simple documentation for implementing DNSSEC properly using simple tools. The steps to implement it are not that difficult, but without proper tools and documentation, nobody is going to find out. My previous post became subject of heated debates, and I have also been invited by NLNetLabs to discuss how we can improve the situation. The post below is meant to shed some light on the matter.

Continue reading

Improving Dnsmasq

Besides having critique on DNS I also try to improve things, both for DNS as well as for the Internet as a whole. Just a few weeks ago I contacted the Dnsmasq community to improve it. The new release is available now for testing and hopefully released soon.

Continue reading