Upload
vudat
View
232
Download
0
Embed Size (px)
Citation preview
Acknowledgement
IwouldliketothankInternetSocietytoletmespendsomeofmyISOCworking-meingo6labandtestallthisnewandexci-ngprotocolsandmechanismsthatmakesInternetabitbeOerandmoresecureplace…
DNSSECimplementa-oningo6lab
• Powerdnsserver(usedasprimaryfornon-signeddomains)as“hidden”primaryDNSserver
• OpenDNSSECplaWormforsigningdomains
• BIND9DNSserversassecondariestoOpenDNSSECtoservesignedzones
• Virtualiza-onused:PROXMOX3.4
• OStemplates:fedora-20,Centos6/7
DNSSECimplementa-oningo6lab
• “Bumpinawire”• Twopublic“primary”servers
• Concept:
DNSSECingo6lab
• Thatwasfairlyeasyanditworksverywell.• Implementa-ondocumentusedfromMaOhijsMekking:
hOp://go6.si/docs/opendnssec-start-guide-drad.pdf
DANEexperiment
• WhenDNSSECwassetupandfunc-oningwestartedtoexperimentwithDANE(DNSAuthen-catedNameEn--es).
• Requirements:– DNSSECsigneddomains– PosWixserverwithTLSsupport>2.11
• WedecidedonPosWix3.0.1
DANE
• TLSArecordformx.go6lab.si
_25._tcp.mx.go6lab.si.INTLSA301B4B7A46F9F0DFEA0151C2E07A5AD7908F4C8B0050E7CC25908DA05E2A84748EDIt’sbasicallyahashofTLScer-ficateonmx.go6lab.siMoreaboutDANE:hOp://www.internetsociety.org/deploy360/resources/dane/
WhatisDANEandhowdoesitwork
DANEverifica-on
• Mx.go6lab.siwasabletoverifyTLScerttoT-2mailserverandnlnet-labsandsomeothers…
mx postfix/smtp[31332]: Verified TLS connection established to smtp-good-in-2.t-2.si[2a01:260:1:4::24]:25: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits) dicht postfix/smtp[29540]: Verified TLS connection established to mx.go6lab.si[2001:67c:27e4::23]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
PosWixconfigsmtpd_use_tls=yessmtpd_tls_security_level=maysmtpd_tls_key_file=/etc/posWix/ssl/server.pemsmtpd_tls_cert_file=/etc/posWix/ssl/server.pemsmtpd_tls_auth_only=nosmtpd_tls_loglevel=1smtpd_tls_received_header=yessmtpd_tls_session_cache_-meout=3600ssmtp_tls_security_level=danesmtp_use_tls=yessmtp_tls_note_starOls_offer=yessmtp_tls_loglevel=1tls_random_exchange_name=/var/run/prng_exchtls_random_source=dev:/dev/urandomtls_smtp_use_tls=yes
MalformedTLSArecord
• WecreatedaTLSArecordwithabadhash(onecharacterchanged)
• PosWixfailedtoverifyitandrefusedtosendamessagemx postfix/smtp[1765]: Untrusted TLS connection established to mail-bad.go6lab.si[2001:67c:27e4::beee]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits) mx postfix/smtp[1765]: 3A4BE8EE5C: Server certificate not trusted
1MtopAlexadomainsandDANE
• Wefetchedtop1millionAlexadomainsandcreatedascriptthatsentanemailtoeachofthem(test-dnssec-dane@[domain])
• Adersometweakingofthescriptwegotsomegoodresults
• Thenwebuiltascriptthatparsedmaillogfileandherearetheresults:
Results
• Outof1milliondomains,992,232ofthemhadMXrecordandmailserver.
• Nearly70%(687,897)ofallaOemptedSMTPsessionstoAlexatop1milliondomainsMXrecordswereencryptedwithTLS
• MajorityofTLSconnec-ons(60%)wereestablishedwithtrustedcer-ficate
• 1,382connec-onswhereremotemailserverannouncedTLScapabilityfailedwith"CannotstartTLS:handshakefailure"
Moreresults
TLSestablishedconnec-onsra-osare:Anonymous:109.753Untrusted:167.063Trusted:410.953Verified:128Quickguide:Anonymous(opportunis-cTLSwithnosignature),Untrusted(peercer-ficatenotsignedbytrustedCA),Trusted(peercer-ficatesignedbytrustedCA)andVerified(verifiedwithTLSAbyDANE).
DANEVerified
Verified:128!!!
Maildistribu-on
MailServers #DomainsHandled TLSState
google.com 125,422 Trusted
secureserver.net 35,759 SomeTrusted,somenoTLSatall
qq.com 11,254 NoTLS
Yandex.ru 9,268 Trusted
Ovh.net 8.531 MostTrusted,withredirectservershavingnoTLSatall
Maildistribu-on
MailServers #DomainsHandled TLSState
Emailsrvr.com 8,262 Trusted
Zohomail.com 2.981 Trusted
Lolipop.jp 1.685 NoTLS
Kundenserver.de 2,834 Trusted
Gandi.net 2,200 Anonymous
DNSSEC?DANE?
Noneofthese“big”mailservers(andtheirdomains)areDNSSECsigned(thatmeantnoDANEforthempossibleuptoJanuary2016).
• Ofcourse,withwrongcer-ficatehashinTLSArecord(refusestosendmail)
• IfdomainwhereMXrecordresidesisnotDNSSECsigned(can’ttrustthedatainMX,sonoverifica-on)
• IfTLSArecordpublishedinnon-DNSSECzone(can’ttrustthedatainTLSA,sonoverifica-on)
WhendoDANEthingsfail?
• go6lab.sizoneissigned,soismx.go6lab.si• thereisTLSAformx.go6lab.si,alsosigned
• Domainsigned.siissignedandMXpointstomx.go6lab.si
• Domainnot-signed.siisnotsignedandMXpointstomx.go6lab.si
• [email protected]@not-signed.si(signed.siandnot-signed.siareusedjustasexamples)
Whendothingsfail?(example)
[email protected](signeddomain):VerifiedTLSconnec-onestablishedtomx.go6lab.si[2001:67c:27e4::23]:25:[email protected](notsigneddomain):AnonymousTLSconnec-onestablishedtomx.go6lab.si[2001:67c:27e4::23]:25:
Whendothingsfail?(example)
• Let’strytopointMXrecordfromsigneddomaintoA/AAAArecordinnot-signeddomainwithTLSAthatisalsonotsigned(obviously)–mail.not-signed.si
Sendmailtojan@signed.siwhenMXforsigned.sipointstomail.not-signed.si–DANEverifica-onisnotevenstartedaschainoftrustisbroken
WhendoDANEverifica-onalsofail?
posWix-3.1-20160103/HISTORY:
20160103
Feature:enableDANEpolicieswhenanMXhosthasasecure
TLSADNSrecord,eveniftheMXDNSrecordwasobtained
withinsecurelookups.TheexistenceofasecureTLSArecord
impliesthatthehostwantstotalkTLSandnotplaintext.Thisbehavioriscontrolledwithsmtp_tls_dane_insecure_mx_policy
(default:"dane",otherse~ngs:"encrypt"and"may";the
laOerisbackwards-compa-blewithearlierPosWixreleases).
ViktorDukhovni.
PosWixlatestimprovementsJ
Let’sEncrypt,DANEandmail
• Let’sEncryptrecommendsusing‘211’and‘311’records• ValidityofLEcertis90days• Bydefaulttheunderlyingkeyischangedwhenrenewing• …soalsocerthashischanged• So,lot’sofworkifyouplantopublish311TLSA• usingthe‘211’methodleadstoanotherissue–namelylack
ofanDSTRootCAX3cer-ficateinthefullchain.pemfileprovidedbytheLet’sEncryptclient
• SoweneedtofetchtheDSTRootCAX3cer-ficateandaddittofullchain.pemfileandverifythatitdidnotchangefromprevious-mewerenewed…
ScripttoaddDSTRootCAX3
lynx--sourcehOps://www.identrust.com/cer-ficates/trus-d/root-download-x3.html|grep-v"\/textarea"|awk'/textarea/{x=NR+18;next}(NR<=x){print}'|sed-e'1i-----BEGINCERTIFICATE-----\'|sed-e'$a-----ENDCERTIFICATE-----\'>>/etc/letsencrypt/live/mx.go6lab.si/fullchain.pem
Valid311and211TLSArecords
But…
• Atnextcer-ficaterenew,bydefaultunderlyingkeywillchangeand311TLSArecordwillbecomeinvalid…
• Laborwise,weneedtokeeptheunderlyingkeythroughtherenewals
• --csrop-oninletsencrypt-autoclient• Indirecotry“examples”thereis“generate-csr.sh”file
Stableunderlyingkey…
./generate-csr.shmx.go6lab.siGenera-nga2048bitRSAprivatekey
................+++
..+++
wri-ngnewprivatekeyto'key.pem'
-----
Youcannowrun:letsencryptauth--csrcsr.der
Renewalsandhashes…• Nowweareusingthesameunderlyingkeyforautoma-crenewalsofcer-ficate,sohashdoesnotchangeand311TLSArecordworks.
• We’llrotatetheunderlyingkeywhenwedecidetoandbeingdrivenbyhumaninterven-on(andalsochangetheTLSA).
• ./letsencrypt-autocertonly-t--debug--renew-astandalone--csr./mx.go6lab.si.der–keep
• Ofcourse,weaddDSTRootCAX3cer-ficatetofullchain.pem
Morereading:
hOp://www.internetsociety.org/deploy360/blog/2016/01/lets-encrypt-cer-ficates-for-mail-servers-and-dane-part-1-of-2/
hOp://www.internetsociety.org/deploy360/blog/2016/03/lets-encrypt-cer-ficates-for-mail-servers-and-dane-part-2-of-2/
Conclusions
• 70%ofemailcanbeencryptedinsomeway,youjustneedtoenableTLSonyourserver
• LownumberofDNSSECsigneddomains/servers
• EvenlowernumberofDANE/TLSAverifiedservers/connec-ons
• It’seasy,goanddoit–it’snottheendoftheworldandithelpswithverifyingwhoareyousendingemailsto–andviceversa;)
ConclusionsII.
• DANEverifica-onfailed(orwasaborted)ifDNSSECchainoftrustisnotfullyestablishedandcompletealongthewholeway.
• TLSAinnot-signedDNSzoneswouldnothelpyoumuchpreven-ngyourcorrespondentssendingemailstoserver-in-the-middle(ifyouarenotrunninglatestbleedingedgedevelopmentversionofPosWix)
• DNSSEC/DANEiseasy,butpleaseunderstandwhatareyoudoingbeforeimplemen-ngitinproduc-on…