home.social

Search

224 results for “nlnetlabs”

  1. ϺΛDИVTTΛH @[email protected] ·

    We have a canary build of our @nlnetlabs #unbound #docker image with #quic support available for testing, yay! 💚

    ➡️ madnuttah/unbound:canary-quic ⬅️

    github.com/madnuttah/unbound-d

    hub.docker.com/r/madnuttah/unb

    #selfhosting #homelab #opensource #foss #dnssec #doq #dnsoverquic #quictls #distroless

    #unbound #docker #quic #selfhosting #homelab #opensource
  2. ϺΛDИVTTΛH @madnuttah ·

    We have a canary build of our @nlnetlabs image with support available for testing, yay! 💚

    ➡️ madnuttah/unbound:canary-quic ⬅️

    github.com/madnuttah/unbound-d

    hub.docker.com/r/madnuttah/unb

    #unbound #docker #quic #selfhosting #homelab #opensource
  3. ϺΛDИVTTΛH @madnuttah ·

    A new release (1.17.1-4) of my @nlnetlabs image has been pushed to hub, the topic is repoducibility and, of course, more security. I've reduced the attack surface a bit more and optimized the dockerfiles a little. Enjoy!

    github.com/madnuttah/unbound-d

    github.com/madnuttah/unbound-d

    #unbound #docker #dns #dnssec #homelab #security
  4. ϺΛDИVTTΛH @madnuttah ·

    My @nlnetlabs image was updated with 3.1.0 and 3.17.2 yesterday, the version reads 1.17.1-3 (Revision 3). Stay safe! 💚

    github.com/madnuttah/unbound-d

    #unbound #dns #resolver #docker #openssl #alpine
  5. ϺΛDИVTTΛH @madnuttah ·

    Wasn't too much work, so the build environment got implemented into my @nlnetlabs image already. You had my promise. The initial build was manual but it should run as an too.

    The first madnuttah/unbound-docker build (v1.19.3-1) with the per architecture optimized libraries is available on . 💚

    github.com/madnuttah/unbound-d

    hub.docker.com/r/madnuttah/unb

    #openssl #unbound #docker #automatedbuild #distroless #dockerhub
  6. Jan Vlug @[email protected] ·

    @lexinova @nlnetlabs @nextcloud @terts

    I wrote once a blog about #GitLab, #GitHub, and #Forgejo (#codeberg). What to choose?

    It is in Dutch, but I'm pretty sure your browser can translate it for you:

    developer.overheid.nl/blog/202

    It is a recommendation for a #GitForge for the Dutch #government.

    Part of the conclusion:
    In summary, from the point of view of digital sovereignty and digital autonomy is a self-hosted Forgejo the best choice for the government.

    #digitalsovereignty #digitalautonomy

    #gitlab #github #forgejo #codeberg #gitforge #government
  7. NLnet Labs @nlnetlabs ·

    With released in Unbound 1.22.0, we turn our attention to finalizing the review to deploy Fast Reload. As the name suggests it allows reloading the resolver configuration with no noticeable interruption of the service. github.com/NLnetLabs/unbound/p

    #dnsoverquic #quic #doq #dns #opensource
  8. NLnet Labs @nlnetlabs ·

    It's been a long road, but we're happy that over is now merged into the main branch of Unbound resolver. We’re now preparing a release. github.com/NLnetLabs/unbound/p

    #dns #quic #doq #opensource
  9. NLnet Labs @nlnetlabs ·

    Since last November, we've been quite busy with security releases for Unbound. Now, with this latest bug fix release out the door, our aim is to get some features released we've been preparing, such as DNS-over-QUIC and upstream cookies. 🍪🍪 github.com/NLnetLabs/unbound/m

    #dns #doq
  10. NLnet Labs @[email protected] ·

    Thanks to @jpmens we now have documentation for Cascade describing how to integrate with a Nitrokey NetHSM to store your DNSSEC keys.

    Thanks a lot! 🧡

    #DNS #DNSSEC #HSM #OpenSource

    cascade.docs.nlnetlabs.nl/en/l

    #dns #dnssec #hsm #opensource
  11. Alex Band @[email protected] ·

    @jpmens @bortzmeyer @themozzie @terts @bal4e

    ReStructuredText and particularly ‘intersphinx’ shenanigans will be the end of me. 🫩

    For now I prevailed, with links from the Cascade docs to the brand new kmip2pkcs11 manpages for setting up your HSM.

    cascade.docs.nlnetlabs.nl/en/l

    #DNS #DNSSEC #Cascade #HSM #documentation

    #dns #dnssec #cascade #hsm #documentation
  12. NLnet Labs @[email protected] ·

    We have a retired SafeNet Luna 4 #HSM in the office for testing our Nameshed HSM code, but we're having a bit of a hard time obtaining a PKCS#11 Linux library / SDK for it.

    (Plan B would be someone giving us testing access to their Thales Luna)

    Is there anyone who can help @ximon18 out? Sharing is caring. 💚 #DNS #DNSSEC #OpenSource

    #hsm #dns #dnssec #opensource
  13. Alex Band @[email protected] ·

    As announced at #RIPE86, the RIPE NCC #RPKI Publication Service is now in production and proving quite popular. 167 CAs are now active, publishing 2100 ROAs, resulting in 3671 VRPs. It’s easy to set this up, and will allow you to sub-delegate resources, do #ASPA, as well as #BGPsec. blog.nlnetlabs.nl/running-kril

    #ripe86 #rpki #aspa #bgpsec
  14. NLnet Labs @nlnetlabs ·

    Perfectly timed for all the discussions at , we’re proud to launch Krill 0.13. This release introduces production grade support in addition to . It also adds a full Trust Anchor support, enabling RIRs to run Krill as their root CA solution. github.com/NLnetLabs/krill/rel

    #routingsecurity #ripe86 #aspa #bgpsec #rpki
  15. NLnet Labs @nlnetlabs ·

    Nearly 20,000 certificates have been issued, and the RPKI publication service is in production. This means you have all the advantages of running Krill - including and support - and publish at the RIPE NCC.

    #rpki #aspa #bgpsec #ripe86
  16. NLnet Labs @nlnetlabs ·

    Our team will be available at as well:
    🛰️ Excited by our modular toolkit Rotonda? It's written in too, making it insanely fast while providing . Talk to @jasper, Luuk or Ximon about our imminent launch.
    🦐 Meanwhile, we’ve been cooking up support to compliment in Krill, our CA software. Tim can tell you all about it, along with our future plans.

    #bgp #routing #ripe86 #opensource #rustlang #memorysafety
  17. NLnet Labs @[email protected] ·

    Krill 0.10.0 is now available, featuring support for #BGPSec Router Certificate Signing and the use of Hardware Security Modules (HSMs) for key operations. #RPKI github.com/NLnetLabs/krill/rel

    #bgpsec #rpki
  18. Royce Williams @[email protected] ·
    CW: New multi-implementation DNSSEC validation DoS vulnerabilities - CVE-2023-50387 ("KeyTrap"), CVE-2023-50868 (NSEC3 vuln)

    (living doc, updated regularly - if you prefer a low-edit post to boost, use infosec.exchange/@tychotithonu)

    Looks like DNS-OARC coordinated fixes in advance, but no centralized analysis at first other than the announcement from the team who discovered KeyTrap:

    Details may be still partially embargoed until patching ramps up.

    Analysis:

    DoS of all major DNSSEC-validating DNS resolvers (servers, but also maybe local resolvers like systemd's?) at the implementation level. Exploitation described as 'trivial'. Both are CVSS 7.5. DNS is a rich ransom target - but some resolver setups don't even validate DNSSEC.

    "In 2012 the vulnerability made its way into the implementation requirements for DNSSEC validation, standards RFC 6781 and RFC 6840" (per ATHENE)

    Per the Unbound writeup, both vulns require query to a malicious zone (which is probably not hard to trigger, for any DNSSEC-enabled client or server).

    Resolution: patch (recommended); disable DNSSEC validation (discouraged, but can buy you time / mitigate active DoS)

    Fixes mitigate the exhaustion by putting caps on validation activities. These caps appear to have been missing from most implementations.

    Details:

    Two DNSSEC DoS CVEs:

    CVE-2023-50387 ("KeyTrap"): "DNSSEC verification complexity can be exploited to exhaust CPU resources and stall DNS resolvers" (CVSS 7.5)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    seclists.org/oss-sec/2024/q1/1

    (KeyTrap was discovered by ATHENE - their press release here has very important detail:
    athene-center.de/en/news/press)

    CVE-2023-50868: "NSEC3 closest encloser proof can exhaust CPU" (CVSS 7.5)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    MITRE links (now populated):
    cve.mitre.org/cgi-bin/cvename.
    cve.mitre.org/cgi-bin/cvename.

    Vulmon queries:
    vulmon.com/searchpage?q=CVE-20
    vulmon.com/searchpage?q=CVE-20

    VulDB:
    vuldb.com/?id.253829

    Resolver status:

    BIND (patched - vuln since 2000?):
    fosstodon.org/@iscdotorg/11192
    kb.isc.org/docs/cve-2023-50387
    kb.isc.org/docs/cve-2023-50868
    seclists.org/oss-sec/2024/q1/1
    isc.org/blogs/2024-bind-securi
    (note: posts say "Versions prior to 9.11.37 were not assessed." but also have a range of affected versions starting at 9.0.0 - typo?)

    BIND tools:
    dig: no validation
    kdig: no validation
    delv: affected, patched

    dnsmasq (patched - 2.90 has fix):
    thekelleys.org.uk/dnsmasq/CHAN
    lists.thekelleys.org.uk/piperm

    Knot (patched in 5.7.1):
    knot-resolver.cz/2024-02-13-kn
    (kzonecheck also affected, patched?)

    ldns-verify-zone:
    affected per ATHENE paper

    OPNsense (patched):
    forum.opnsense.org/index.php?t

    pfSense:
    (Bundled Unbound: plan appears to be to make a separate package available for manual update?; BIND: optional package)
    forum.netgate.com/topic/186145
    redmine.pfsense.org/issues/152

    Pi-Hole (uses dnsmasq - patch available)
    patreon.com/posts/dnssec-fix-9
    pi-hole.net/blog/2024/02/13/fi

    PowerDNS (patched - all versions affected):
    blog.powerdns.com/2024/02/13/p
    github.com/PowerDNS/pdns/pull/
    github.com/PowerDNS/pdns/pull/
    seclists.org/oss-sec/2024/q1/1

    Stubby:
    [?]
    github.com/getdnsapi/stubby

    systemd.resolved:
    [?]

    Ubiquiti
    [?]

    Unbound (patched - vuln since Aug 2007):
    nlnetlabs.nl/news/2024/Feb/13/
    nlnetlabs.nl/downloads/unbound
    seclists.org/oss-sec/2024/q1/1

    Library status:*
    dnspython (GitHub patched):
    affected per ATHENE paper
    github.com/rthalley/dnspython/

    getdns (used by stubby - no patched release?):
    affected per ATHENE paper
    getdnsapi.net/releases/

    ldns (not yet patched?):
    affected per ATHENE paper
    github.com/NLnetLabs/ldns

    libunbound (used by Unbound):
    affected per ATHENE paper
    no recent patches?
    github.com/NLnetLabs/unbound/t

    Cloud status:

    Akamai:
    akamai.com/blog/security/dns-e

    Cloudflare:
    blog.cloudflare.com/remediatin

    Google DNS:
    (stated as patched in Register and SecurityWeek articles)
    [?]

    NextDNS (patched per forum reply):
    help.nextdns.io/t/h7yxwc5/does

    OS status:

    Debian:
    BIND:
    lists.debian.org/debian-securi
    pdns-recursor:
    lists.debian.org/debian-securi
    Unbound:
    lists.debian.org/debian-securi

    Fedora:
    bodhi.fedoraproject.org/update

    FreeBSD:
    cgit.freebsd.org/ports/commit/

    Gentoo:
    bugs.gentoo.org/show_bug.cgi?i

    Mageia:
    bugs.mageia.org/show_bug.cgi?i

    OpenBSD (unwind):

    Red Hat:
    bugzilla.redhat.com/show_bug.c
    access.redhat.com/security/cve
    access.redhat.com/security/cve

    SUSE:
    suse.com/security/cve/CVE-2023
    bugzilla.suse.com/show_bug.cgi

    Ubuntu:
    ubuntu.com/security/CVE-2023-5
    ubuntu.com/security/CVE-2023-5
    ubuntu.com/security/notices/US

    Windows (Server, DNS Role):
    msrc.microsoft.com/update-guid

    Package status:

    BIND:
    repology.org/project/bind/vers

    dnsmasq:
    repology.org/project/dnsmasq/v

    Unbound:
    repology.org/project/unbound/v

    GitHub:
    github.com/advisories/GHSA-845

    Go (Knot module?)
    github.com/golang/vulndb/issue

    Non-coverage: (no mentions known yet)

    AWS :
    [?]

    Azure (Microsoft Server DNS?):
    [?]

    Cisco Umbrella:
    umbrella.cisco.com/blog [?]

    CoreDNS:
    coredns.io/blog/ [?]

    Infoblox:
    blogs.infoblox.com/ [?]

    Quad9 DNS:
    quad9.net/news/blog/ [?]

    News/Press/Forums

    pducklin.com/2024/02/18/the-sc

    theregister.com/2024/02/13/dns

    securityweek.com/keytrap-dns-a

    bleepingcomputer.com/news/secu

    news.ycombinator.com/item?id=3

    darkreading.com/cloud-security

    Detection/Validation:

    Check to see if a server is doing DNSSEC validation (if not an open recursive resolver, you may need to query a zone the server is authoritative for):

    # zone signed, server DNSSEC-enabled:
    $ delv example.net @8.8.8.8
    ; fully validated
    example.net.            4437    IN      A       93.184.216.34
    example.net.            4437    IN      RRSIG   A 13 2 86400 20240225232039 20240204162038 18113 example.net. 94G2PRXins1G9ntfklvCq2mvcgqjB0z9FqQXp77lD/wXR4J3D67ceih1 yNgsYYqlIAOoWKXUekux6Zq9aIwszQ==

    # zone unsigned, server DNSSEC-enabled:
    $ delv google.com @8.8.8.8
    ; unsigned answer
    google.com.             100     IN      A       142.250.69.206

    Tenable:
    tenable.com/plugins/pipeline/i

    Snyk:
    security.snyk.io/vuln/SNYK-UNM

    Exploits:

    (multiple sources describe as "trivial")

    github.com/knqyf263/CVE-2023-5 (not tested)

    #keytrap #nsec3 #CVE202350387 #CVE202350868 #CVE_2023_50387 #CVE_2023_50868
    #dns #dnssec

    #keytrap #nsec3 #cve202350387 #cve202350868 #cve_2023_50387 #cve_2023_50868
  19. NLnet Labs @nlnetlabs ·

    Our `domain` crate for is progressing in three parallel tracks: Ximon's Zone transfers with is nearing completion, a proof of concept for query routing by Philip is ready for review so he can turn his attention to the signing milestone, and Terts and Jannik have kicked off reimplementing the `ldns` tools and example programs in .

    All development is and in the open you can follow the progress and contribute: github.com/NLnetLabs/domain/pu

    #dns #rustlang #xfr #tsig #dnssec #rust
  20. NLnet Labs @nlnetlabs ·

    When building a library, it's not just about providing features but getting the ergonomics right so that developers can take maximum advantage of the functionality provided. After several approaches, we're finally happy with Zone Transfers for our `domain` crate for .
    github.com/NLnetLabs/domain/pu

    #dns #opensource #rustlang #codingintheopen #ixfr #axfr
  21. Alex Band @[email protected] ·

    I'm obsessed with good #documentation and the Routinator user manual on #ReadTheDocs is my pride and joy.

    We worked very hard to seamlessly integrate the manual page into it as well, allowing us to automatically link command line options, but we also wanted it to be the canonical source for building the the manpage with rst2man. This saves us from keeping content in sync and messing with troff(1).

    github.com/NLnetLabs/routinato

    #WriteTheDocs #TechnicalWriting #TechnicalDocumentation #OpenSource

    #opensource #technicaldocumentation #technicalwriting #writethedocs #readthedocs #documentation
  22. NLnet Labs @[email protected] ·

    Thanks to the @Nominet DNS Fund, we have been able to dedicate a team of five developers on building Cascade, our new #OpenSource #DNSSEC signing solution.

    Leading up a first production release in June, @ximon18 will be presenting on our progress at the @dnsoarc 46 workshop in Edinburgh in May.

    Highlights will include new incremental signing and IXFR-out, performance/resource usage improvements, TSIG support, metrics, migration tooling, and more...

    indico.dns-oarc.net/event/56/c

    #DNS #LoveDNS

    #opensource #dnssec #dns #lovedns
  23. NLnet Labs @[email protected] ·

    Nice to see that @oli is seeing the bigger picture of Cascade, and the opportunities a modular #DNSSEC pipeline offers.

    This is why we love developing this together with the #DNS operator community. Keep the feedback coming!

    #OpenSource #LoveDNS

    github.com/NLnetLabs/cascade/i

    #dnssec #dns #opensource #lovedns
  24. NLnet Labs @[email protected] ·

    We've released Rotonda 0.5.2, our BMP/BGP route collector, bringing back the web UI in totally revamped fashion. It's still simplistic, by design, but now offers a lot more insight in both the actual routes as well as session information.

    As the UI is still evolving, we are gathering feedback. please chime in with anything that comes to mind:
    community.nlnetlabs.nl/t/web-u

    github.com/NLnetLabs/rotonda/r
    #BGP #BMP #RustLang

    #bgp #bmp #rustlang
  25. NLnet Labs @[email protected] ·

    When building a library, it's not just about providing features but getting the ergonomics right so that developers can take maximum advantage of the functionality provided. After several approaches, we're finally happy with #DNS Zone Transfers for our #OpenSource `domain` crate for #rustlang. #CodingInTheOpen #IXFR #AXFR #TSIG
    github.com/NLnetLabs/domain/pu

    #dns #opensource #rustlang #codingintheopen #ixfr #axfr
  26. NLnet Labs @[email protected] ·

    When building a library, it's not just about providing features but getting the ergonomics right so that developers can take maximum advantage of the functionality provided. After several approaches, we're finally happy with #DNS Zone Transfers for our #OpenSource `domain` crate for #rustlang. #CodingInTheOpen #IXFR #AXFR #TSIG
    github.com/NLnetLabs/domain/pu

    #dns #opensource #rustlang #codingintheopen #ixfr #axfr
  27. NLnet Labs @[email protected] ·

    When building a library, it's not just about providing features but getting the ergonomics right so that developers can take maximum advantage of the functionality provided. After several approaches, we're finally happy with #DNS Zone Transfers for our #OpenSource `domain` crate for #rustlang. #CodingInTheOpen #IXFR #AXFR #TSIG
    github.com/NLnetLabs/domain/pu

    #tsig #axfr #ixfr #codingintheopen #rustlang #opensource
  28. NLnet Labs @[email protected] ·

    When building a library, it's not just about providing features but getting the ergonomics right so that developers can take maximum advantage of the functionality provided. After several approaches, we're finally happy with #DNS Zone Transfers for our #OpenSource `domain` crate for #rustlang. #CodingInTheOpen #IXFR #AXFR #TSIG
    github.com/NLnetLabs/domain/pu

    #dns #opensource #rustlang #codingintheopen #ixfr #axfr
  29. NLnet Labs @nlnetlabs ·

    We are thrilled to announce the release of version 0.10.2 of domain, our library that provides essential building blocks for working with . This latest version introduces several new features, including a validator, zone transfers, client and server transport, TSIG request signing and response validation, and much more. For more information, please visit our GitHub repository: github.com/NLnetLabs/domain/re

    #opensource #rustlang #dns #dnssec #xfr
  30. NLnet Labs @nlnetlabs ·

    With Zone Transfers merged into the main branch of 'domain’, our library for , we're now turning our attention to signing! We're also excited that @bal4e has joined this effort. 💚 github.com/NLnetLabs/domain/pu

    #xfr #dns #rustlang #dnssec
Next page