# Introduction

We’ll turn DNSSEC validation on our group resolver.

## Notes

- Commands preceded with “$” imply that you should execute the command as a general user - not as root.
- Commands preceded with “#” imply that you should be working as root.
- Commands with more specific command lines (e.g. “rtrX>” or “mysql>”) imply that you are executing commands on remote equipment, or within another program.

# Overview

Each cluster of machines in group XX includes a resolver, which you have already configured. It is running unbound, and you have already edited `/etc/resolv.conf` on all your servers so that they will use this resolver by default.

For example, in Group 4 your resolver is called `resolv.grp4.dns` and has address 10.4.1.2.

    $ host resolv.grp4.dns

    resolv.grp4.dns has address 10.4.1.2

Log in to YOUR resolv server, now. Yours. Not group 4’s. If everybody winds up configuring group 4’s server, it will make group 4 sad.

## Obtain a trust anchor

We have a private root server in the workshop. We are going to use the KSK from that local root zone KSK as our trust anchor, not the one from the real DNS. There are several ways you can get the key:

- Paste it from here:

    .           120 IN DNSKEY 257 3 13 (
                    nzJ4ea86OBpRCnkmcdoHBiQxfPMNvAvCvbyMiW4OgF+0
                    uYaeP2lZeIiAH72J3W1CWX/UrsgZa1c7abxDuhkdTw==
                    ) ; KSK; alg = ECDSAP256SHA256 ; key id = 56771

- Pull it from the local root server directly:

    $ dig @10.0.0.237 . DNSKEY +multiline

The `+multiline` parameter to dig just makes the output easier to read. This dig command gives you two keys. Why? Which one should you use?

- find it on the class web page, here:

    http://www.dns/WORKSHOP-NAME/labs/nsrc-root-key.txt

Background reading: if you’re interested in ways to obtain the trust anchor in the real root zone on the Internet, check out RFC 7958, https://tools.ietf.org/html/rfc7958.

## Install the trust anchor

The trust anchor should be installed on your resolver as `/var/lib/unbound/root.key`. That file is already there, but you need to replace it with the trust anchor that makes sense for the workshop (from step 1).

    sysadm@resolv:~$ cd /var/lib/unbound
    sysadm@resolv:/var/lib/unbound$ ls

    root.key

Rename the existing file as something else so that it won’t be used, and replace it with a new file (replace EDITOR with the editor you like to use):

    sysadm@resolv:/var/lib/unbound$ sudo mv root.key root.key.old
    sysadm@resolv:/var/lib/unbound$ sudo EDITOR root.key
    sysadm@resolv:/var/lib/unbound$ cat root.key

    .       120 IN DNSKEY 257 3 13 (
                nzJ4ea86OBpRCnkmcdoHBiQxfPMNvAvCvbyMiW4OgF+0
                uYaeP2lZeIiAH72J3W1CWX/UrsgZa1c7abxDuhkdTw==
                ) ; KSK; alg = ECDSAP256SHA256 ; key id = 56771

## Tell Unbound to use the new trust anchor you have installed.

    sysadm@resolv:~$ cd /etc/unbound/unbound.conf.d
    sysadm@resolv:/etc/unbound/unbound.conf.d$ ls

    class.conf  qname-minimisation.conf  root-auto-trust-anchor-file.conf

The configuration you want to change is in the root-auto-trust-anchor- file.conf file. Uncomment the configuration that starts with the line `trust-anchor-file`.

## Restart Unbund

    sysadm@resolv:~$ sudo systemctl restart unbound

## Check that Unbound is now able to give you validated answers

    sysadm@resolv:~$ dig @127.0.0.1 . soa +multiline

      ; <<>> DiG 9.11.3-1ubuntu1.5-Ubuntu <<>> @127.0.0.1 . soa +multiline
      ; (1 server found)
      ;; global options: +cmd
      ;; Got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53228
      ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

      ;; OPT PSEUDOSECTION:
      ; EDNS: version: 0, flags:; udp: 4096
      ;; QUESTION SECTION:
      ;.            IN SOA

      ;; ANSWER SECTION:
      .         75 IN SOA ns1.root. hostmaster.root. (
                    2019031807 ; serial
                    3600       ; refresh (1 hour)
                    1800       ; retry (30 minutes)
                    604800     ; expire (1 week)
                    300        ; minimum (5 minutes)
                    )

      ;; AUTHORITY SECTION:
      .         75 IN NS ns1.root.
      .         75 IN NS ns2.root.

      ;; ADDITIONAL SECTION:
      ns1.root.     75 IN A 10.0.0.237
      ns2.root.     75 IN A 10.0.0.238

      ;; Query time: 0 msec
      ;; SERVER: 127.0.0.1#53(127.0.0.1)
      ;; WHEN: Tue Mar 19 08:05:11 UTC 2019
      ;; MSG SIZE  rcvd: 144

How can you tell that the recursive server you are using is doing DNSSEC validation?