Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #268004

Re: DNSSEC status of deb.debian.org

Show all headers | View raw

On 03/03/2024 14:06, Andy Smith wrote:
> Hi,
> 
> On Sun, Mar 03, 2024 at 09:39:42AM +0000, Andre Rodier wrote:
>> I was checking the Debian domain, and noticed that it is DNSSEC compliant.
>>
>> However, when I check "deb.debian.org", the DNS validation fails.
> 
> Things in the debian.org domain are responding correctly with DNSSEC
> but deb.debian.org is a CNAME to debian.map.fastlydns.net, and
> *that* domain doesn't (yet?) use DNSSEC.
> 
> $ delv deb.debian.org
> ; fully validated
> deb.debian.org.         3600    IN      CNAME   debian.map.fastlydns.net.
> deb.debian.org.         3600    IN      RRSIG   CNAME 8 3 3600 20240405180549 20240225172415 59788 debian.org. YnRgyoBEdwn9PHKTN9pIHNp+VyY+J0hripSOOV7feEsJmgfJwwslnsTR pC0QTkKZQlNflC2sPGqAc5/sKSHHGkHdKYemVCH7IcDTKOZ6wilVUlvT zumWhTZDk+ntLoptwmDblI6emnj8z8wimiFuyGv3+bU16RbdzdFvMdQI Ys9Ldyz6eQSMMyD58OwpiwDxFWjns92iUb05VB+yLeVeFwQ9uvJW1lZa oASmDhoyNijntU9UjA6h/Bzx6ZJvLHlE
> 
> ; unsigned answer
> debian.map.fastlydns.net. 30    IN      A       146.75.74.132
> 
>> After checking the status using Verisign
>> (https://dnssec-debugger.verisignlabs.com/deb.debian.org), I understand
>> Debian is using a CDN (Content Delivery Network).
>>
>> Is there a stable domain we can use that doesn't rely on a CDN, please ?
> 
> I am left to wonder what problem(s) you are trying to avoid by "not
> relying on a CDN", but you can just use a different mirror.
> 
> But note that Debian mirrors are operated by many diverse
> organisations and individuals, most of which probably aren't Debian
> developers. Debian itself has no legal entity; SPI, inc only deals
> with some financial matters, so trying to form a notion of any kind
> of legislative or administrative control structure is difficult.
> 
> Or to put it another way, if it bothers you that responsibility for
> operation of a mirror passes outside of the people who control the
> debian.org zone, I have bad news for you.
> 
> For example, if you chose ftp.uk.debian.org…
> 
> $ delv ftp.uk.debian.org
> ; fully validated
> ftp.uk.debian.org.      300     IN      CNAME   debian.hands.com.
> ftp.uk.debian.org.      300     IN      RRSIG   CNAME 8 4 300 20240401002934 20240220235036 59788 debian.org. Pu+9FflqjMDfCjNxUoQy32dA5X3atU92LH3hozdZcDk3ZZwtyqcAoA6x IZSLZEzJvXa6+gTd3P0pOib+rIoypUYz47OulgYTWqQdLILtV3cRMVxU hf+z5xOYmOzzwSKAuI7iho4PNCmChccyfFdc3p4nKtciQmyWYbUeNJRu s83Ki0YEdvgMP+74HCwH6BNUEFhCuYFeDc+XWTzwg55EDSAmyMdXU9rl BRfpyCg4VU0NeJMFGci5sxKooAwbstvs
> 
> ; unsigned answer
> debian.hands.com.       14030   IN      A       78.129.164.123
> 
> …you again end up at something that doesn't use DNSSEC. It isn't a
> CDN though, so maybe you like it more (?).
> 
> I haven't gone through all of the mirrors to see if there are any
> ones that use DNSSEC. I wouldn't be surprised if there were some,
> but again, I don't know what your threat model is so I'm not
> suggesting this matters.
> 
> Thanks,
> Andy
> 


Thanks for the answer, Andy.

This make sense.

Kind regards,
André Rodier

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

DNSSEC status of deb.debian.org Andre Rodier <andre@rodier.me> - 2024-03-03 10:50 +0100
  Re: DNSSEC status of deb.debian.org Max Nikulin <manikulin@gmail.com> - 2024-03-03 15:10 +0100
    Re: DNSSEC status of deb.debian.org Andre Rodier <andre@rodier.me> - 2024-03-03 15:30 +0100
  Re: DNSSEC status of deb.debian.org Andy Smith <andy@strugglers.net> - 2024-03-03 15:10 +0100
    Re: DNSSEC status of deb.debian.org Greg Wooledge <greg@wooledge.org> - 2024-03-03 15:30 +0100
    Re: DNSSEC status of deb.debian.org Andre Rodier <andre@rodier.me> - 2024-03-03 15:40 +0100

csiph-web