Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am doing a research project on DNSSec.

I have a SOA, Stub resolver and a client as well as a attack machine.

My question is this. On a Linux Client is there a way test for validity of record after after a DNS poisoning attack. This check needs to be done at the command line.

I have verified that the DNSSec records are being forwarded on.

share|improve this question

1 Answer 1

According to http://backreference.org/2010/11/17/dnssec-verification-with-dig/:

Obtain root keys. You can do this with dig on an unpoisoned machine:

dig . DNSKEY | grep -Ev '^($|;)' > root.keys

Verify your target dns record:

dig +sigchase +trusted-key=./root.keys www.eurid.eu. A | cat -n

The other alternative is to set up a validating DNS resolver like unbound. I use it to provide DNSSEC security on desktop machines. It's easily available in Fedora 17. Or BIND in Debian 7.0. I forget whether there are debian packages which set up unbound for you, but it's not hard to do manually either.

Then run dig against your secure resolver, and it will show a flat error (SERVFAIL, I think) if there are invalid results. You can also configure unbound to log details about each validation failure.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.