tutorials:dns:dnssec
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| tutorials:dns:dnssec [2013/04/21 12:32] – [Adding SIP Users] miconda | tutorials:dns:dnssec [2013/04/25 10:49] (current) – mariuszbihlei | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Kamailio with DNSEC ====== | + | ====== Kamailio with DNSSEC |
| - | The **dnssec** module was added during the development of v4.1.0 (expected to be released later in 2013). Therefore this tutorial presents how to add DNSSEC module in the default configuration file of Kamailio, following GIT installation guidelines. | + | The **dnssec** module |
| In short, this tutorial focuses on: | In short, this tutorial focuses on: | ||
| Line 8: | Line 8: | ||
| * add DNSSEC support to configuration file | * add DNSSEC support to configuration file | ||
| - | Note: Ubuntu 12.04 was chosen because dnssec tools devel library are provided for this distribution. | + | **Note:** the DNSSEC module is several days old at the time of writing initial version of this tutorial. For any assistance, email to **< |
| + | |||
| + | * http:// | ||
| + | |||
| + | **Note: | ||
| ===== About DNSSEC ===== | ===== About DNSSEC ===== | ||
| Line 29: | Line 33: | ||
| ==== DNSSEC Tools Devel Libraries Installation ==== | ==== DNSSEC Tools Devel Libraries Installation ==== | ||
| - | You need these libraries to compile Kamailio' | + | You need DNSSEC tools devel libraries to compile Kamailio' |
| * http:// | * http:// | ||
| Line 38: | Line 42: | ||
| dns-validator_2.0-1_i386.deb | dns-validator_2.0-1_i386.deb | ||
| libval-threads_2.0-1_i386.deb | libval-threads_2.0-1_i386.deb | ||
| - | libsres_2.0-1_i386.deb | ||
| libval-threads-dev_2.0-1_i386.deb | libval-threads-dev_2.0-1_i386.deb | ||
| + | libsres_2.0-1_i386.deb | ||
| libsres-dev_2.0-1_i386.deb | libsres-dev_2.0-1_i386.deb | ||
| </ | </ | ||
| Line 184: | Line 188: | ||
| < | < | ||
| - | / | + | |
| </ | </ | ||
| + | The default file for init.d script is provided at: | ||
| - | Next is a script to install it: | ||
| - | Just copy the init file into the / | ||
| < | < | ||
| - | | + | / |
| - | chmod 755 / | + | |
| - | cp / | + | |
| </ | </ | ||
| - | Edit the file **/etc/init.d/kamailio** to update the $DAEMON value: | + | Run next command to deploy |
| - | < | + | |
| - | DAEMON=/ | + | |
| - | </ | + | |
| - | + | ||
| - | Edit the file **/ | + | |
| < | < | ||
| - | | + | |
| </ | </ | ||
| - | You can edit the other options at your convenience. | + | It will create also user and group **kamailio**, plus runtime directory **/ |
| - | + | ||
| - | Create the directory for pid file: | + | |
| - | + | ||
| - | < | + | |
| - | mkdir -p / | + | |
| - | </ | + | |
| - | + | ||
| - | Default setting is to run Kamailio as user " | + | |
| - | + | ||
| - | < | + | |
| - | adduser --quiet --system --group --disabled-password \ | + | |
| - | --shell /bin/false --gecos " | + | |
| - | --home | + | |
| - | + | ||
| - | # set ownership to / | + | |
| - | chown kamailio: | + | |
| - | </ | + | |
| - | Then you can start/ | + | Now Kamailio |
| < | < | ||
| Line 234: | Line 213: | ||
| </ | </ | ||
| - | ===== Update Kamailio | + | |
| + | ===== Update Kamailio | ||
| Next step is to enable user authentication, | Next step is to enable user authentication, | ||
| Line 242: | Line 222: | ||
| </ | </ | ||
| - | Follow the instruction in the comments to enable usage of MySQL. Basically you have to add several lines at the top of config file, like: | + | Follow the instruction in the comments to enable usage of MySQL. Basically you have to add several lines at the top of config file (but after the first line), like: |
| < | < | ||
| Line 253: | Line 233: | ||
| ==== Add DNSSEC Module ==== | ==== Add DNSSEC Module ==== | ||
| + | |||
| + | The README of DNSSEC module is available at: | ||
| + | |||
| + | * http:// | ||
| You have to load dnssec module in kamailio.cfg: | You have to load dnssec module in kamailio.cfg: | ||
| Line 263: | Line 247: | ||
| The module does not require any parameter, you are ready to use the configuration file now. | The module does not require any parameter, you are ready to use the configuration file now. | ||
| + | |||
| + | Start Kamailio with: | ||
| + | |||
| + | < | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | ===== DNS Server DNSSEC Enabled ===== | ||
| + | |||
| + | This tutorial does not include yet (left for future updates) how to setup a DNSSEC-enabled DNS server, there are many useful resources on the web. Among them: | ||
| + | |||
| + | * http:// | ||
| + | * http:// | ||
| + | ===== Testing ===== | ||
| + | |||
| + | One way to test is to setup two instances of Kamailio, one serving domainA.com and the second domainB.com. | ||
| + | |||
| + | Then alice@domainA.com can call bob@domainB.com. Kamailio instance serving domainA.com will do DNS lookup do discover the IP address of domainB.com | ||
| + | |||
| + | One easy way to test is to use a Open DNS resolver that provides Recursive DNSSEC capabilities. One of those is 8.8.8.8 ( Google Open DNS). | ||
| + | As per the FAQ, DNSSEC support is enabled (https:// | ||
| + | |||
| + | Edit / | ||
| + | |||
| + | Launch Kamailio with DNSSEC module enabled and try to send a SIP package to the domain www.dnssec-failed.org. DNS resolving for this domain should fail, as it is a test domain which provides an incorrect signature. Kamailio should report: | ||
| + | " | ||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | ===== Remarks ===== | ||
| + | |||
| + | * setup of a DNS server with DNSSEC support is left for future updates of this tutorial | ||
| + | * the DNSSEC module overwrites the API in the core for doing DNS queries, therefore is nothing else required to do apart of loading the module | ||
| + | * Kamailio will do a DNS query each time it has to forward a SIP request based on hostname | ||
tutorials/dns/dnssec.1366547575.txt.gz · Last modified: 2013/04/21 12:32 by miconda