Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am doing a research project on The Domain Name System Security Extensions (DNSSEC).

I have a SOA, Stub resolver and a client as well as a attack machine.

My question is this. Is there a way to test the validity of the record, after a DNS poisoning attack on a Linux client. This check needs to be done from a command line interface.

I verified that the DNSSEC records are set.

share|improve this question

According to http://backreference.org/2010/11/17/dnssec-verification-with-dig/:

Obtain root keys. You can do this with dig on an unpoisoned machine:

dig . DNSKEY | grep -Ev '^($|;)' > root.keys

Verify your target dns record:

dig +sigchase +trusted-key=./root.keys www.eurid.eu. A | cat -n

The other alternative is to set up a validating DNS resolver like unbound. I use it to provide DNSSEC security on desktop machines. It's easily available in Fedora 17. Or BIND in Debian 7.0. I forget whether there are debian packages which set up unbound for you, but it's not hard to do manually either.

Then run dig against your secure resolver, and it will show a flat error (SERVFAIL, I think) if there are invalid results. You can also configure unbound to log details about each validation failure.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.