ͥåȥڥꥹ - SE̼η -

ͥåȥڥꥹȤλкȤǤͥåȥڥꥹȻι
̡ʤΥġ⡢μʤɤξǺܤޤкߥʡԤäƤޤ ͥåȥڥꥹ
кʤ麸κǤܤ֥ͥڡץ꡼ʵɾҡˤǡ
ͥåȥڥꥹȻ˹ʤȡͥåȥ˴ؤμ䵻ѤǤʤɲϤʸϤȤˤĤޤ
ˡλ˹ʤǤȤ뤳ȤǤޤ

ƥꡧ10.ץꥱءL5L7 > 10.3 DNS

IPɥ쥹ϥ󥿡ͥåȤνȹͤФ褤㤨˿ǼҤν̰ޤФοɽȡʲΤ褦ˤʤ롣̰3541ʬ,13945ʬ
ȤɤˤΤʬˤФˤǡĶĮ1-3-7פɽСʹ֤ʬ䤹줬DNSȹͤƤߤƤϤɤ⡢ع¤
ľΩ

DNSDomain Name SystemˤλȤߤ䡢å奵СƥĥСƵ䤤碌ΰ̣ưή˲äƥкϰʲΥȤˤǫ˲⤵Ƥ롣
http://www.ipa.go.jp/security/vuln/documents/DNS_security.pdf (󥯡

ڡϤ뤬DNS򤹤ˤϤȤƤɤǤ
ޤDNS򤹤Ǥ⤤ˡϡʬDNSФΩƤ뤳ȤǤ롣
ּ𥵡С״ϢܤѰդŤʤäPCܤźդCDLinux򥤥󥹥ȡ뤹롣ơDNSФΩƤƤߤ褦ɥᥤ1000٤ǼǤ롣

ͣ
DNSROOTФ13Ĥ롣13Ȥ櫓ǤϤʤDNS롼ȥФǾĹƤΤǡϻۤɤ롣
DNSФۤ顢٥롼ȥե򸫤Ƥۤܤˤ⥵Фꡢ13ܤMǤ롣

ͣˤɤǤ⤤
example.comϡʤɤΤ˼ͳˤĤäƤïΥɥᥤ뤳ȤϤǤʤ

ߤƤߤ褦
DNSΤٶˤʤΤǡ󥸤Ƥۤºݤˤ϶
󥿡ͥåȤǻȤɥᥤ̾ڤIPɥ쥹,  DNSѤƴƤ롣DNS,¿DNSФǹ[a]ǡ١Ǥ,롼DNSФĺȤ,ɥᥤ֤̾ȸƤФĥ꡼¤Ƥ롣
󥿡ͥåȤǤ,[b][c]θ,13Υ롼DNSФ֤Ƥ롣
DNSΥĥ꡼¤κǾ̤˰֤롼DNSФ۲ˤ,ɥᥤ̾(:jpɥᥤ,co.jpɥᥤʤ)бDNSФ롣ɥᥤ̾DNSФ˴ؤ,ĥ꡼¤[d]Υɥᥤ̾DNSФݻƤ롣ۥȤ˴ؤ,ΥۥȤ°ɥᥤ̾DNSФݻƤ롣
ɥᥤ̾,www.example.co.jpΤ褦ΥۥȤɽɥᥤ̾[e]ȸƤ֡
ά
ĤΥɥᥤDNSФ,̾[c]θ2ΥФǹ롣[f]⤦[g]ȸƤ֡
H18SW11

ϰʲ


c

eFQDN
fץ饤ޥꥵ
gꥵ

URLUniform Resource LocatorˤϡWebڡξ򼨤ɽˡH22IP74ˡפǤ
FQDNϡFully Qualified Domain Nameɥᥤ̾פǤH18SW壱䣱ˤǤϡ֥ɥᥤ̾,www.example.co.jpΤ褦ΥۥȤɽɥᥤ̾FQDNȸƤ֡פȤޤ

Q.FQDNȥۥ̾ɥᥤ̾δطϡ

ۥ̾Ȥϡԥ塼ˤĤ줿̾Ǥ롣WindowsΥԥ塼̾Ȥϼ㴳㤦ΤǡӲ⤹뤬ǤƱȤƹͤ褦ɥᥤ̾Ϥ¸yahoo.co.jpʤɤΥɥᥤ̾Ǥ롣FQDNϡɥᥤ̾Ȥ̣ǡ˽ʸˤ줿ɥᥤ̾Ȥ̣Ǥ롣
ͥåȥڥꥹȤܻؤSEϥƥ

򽤾ʸˤƤΡ
ۥȤǤ롣ɥᥤ̾seeeko.comˤǤС᡼륵ФWebСDNSФʤɤ¿ΥФꡢۥȤ1Ĥ˸ǤʤĤޤꡢIPɥ쥹ǤʤDNSФǤϡɥᥤǤʤۥ̾롣ɤ餫ǤIPɥ쥹ǤʤFQDNIPɥ쥹бŤƴƤ롣飳ԤURLäƴطϰʲˤʤ롣
URL


TLDʺǾ̤Υɥᥤ
TLDTop Level DomainˤϡֺǾ̤ΥɥᥤפΤȤǤ
Ūˤ.com .net .jp .orgʤɤޤ

򸫤Ƥߤޤ礦

H27IP
60http://example.co.jp/index.htmlɤǼURLΥȥåץ٥ɥᥤTLDˤϤɤ줫
http
example
co
jp




jp

Q1. DNSǴΤϡԥ塼̾ȥۥ̾Τɤ餫
1


⤽⤳2ĤʪǤ
WindowsǤʪǤ롣
Ǥ⡢ƱȹͤƤƤ⡢礭Ϥʤ
ξԤΰ㤤ñ˽񤯡

1)ԥ塼̾NETBIOS̾
ϻȤʤʤäNETBEUIȤץȥǤ̾

2)ۥ̾
TCP/IPѤ
ɥᥤˤĥ꡼¤γǰ롣www.yahoo.co.jpʤɡ


Q2.Ǥ̾ˡϡ
1)ԥ塼̾
WinsФlmhostsե

2)ۥ̾
DNSФhostsե
ۤŤ

ԥ塼̾ȥۥ̾㤦ȤϤΡ
DNSξϤǸäȤϡNETBIOSΥԥ塼̾ȡTCP/IPΥۥ̾ΰ㤤äΤǤϤʤ
DNSγǰä
㤨Сԥ塼̾WebSV1Ȥ̾ĤDNSФǤϡΥԥ塼WWWȤۥ̾Ĥ뤳ȤǤ롣줬DNSФǤ롣ޤDNS饦ɥӥλȤߤˤꡢWebSV1ǤʤWebSV2WebSV3ˤ⡢WWWȤۥ̾бդ뤳ȤǤΤ

H23NW孶2ˤˡDNSΥե㤬ΤǷǺܤ롣
$TTL 86400 ;1
@ IN SOA ns.y-sya.example.co.jp. hostmaster.y-sya.example.co.jp.(
2011090101 ; serialֹ桡
43200 ; refresh (12)
1800 ; retry (30ʬ)
604800 ; expire (7)
10800 ); negative cache (3)
IN NS ns.y-sya.example.co.jp.
IN MX 10 mail.y-sya.example.co.jp.
İIJ⤹롣
ϸεǾܤܤ
ϴȹͤФȾDNSФ̾򵭺ܡhostmaster.y-sya.example.co.jpϡԤΥ᡼륢ɥ쥹hostmaster@y-sya.example.co.jpȤ̣
serialֹ档DNSФϡͤƤ顢DNSѹ줿ȽǤ롣ƤѤƤ⡢ͤ䤵ʤä顢DNSϾʤǯ֤ǵܤ뤳Ȥ¿
DNSФץ饤ޥDNSФ˾ֳ
嵭ԤΥȥ饤ֳ
嵭˼Ԥ³硢ΥѴޤǤλ֡TTLϡü¦ΥåǤΤǡʪ
Negative cacheMINIMUMɽ뤳Ȥ⤢ˤϡʤäΥå֤Ǥ롣
3
褯狼ʤΤǤ
ѥ󤬡ʤä򥭥å夹ΤϤ狼ޤ
Ǥ⡢DNSФϼʬäƤ¦Ǥ͡
ä顢ʤäΥåäƤʤǤ?
Negative cacheDNSΥå奵ФǤΤѤ롣TTLDNSΥå֡Negative cacheϰʤäDNSΥå֤ʤΤǡڥǹͤȤ狼䤹


Q.DNSФǡե򥳥ԡ٤ݤåֳִ֤H23NW孶24(3)

ޥɥåƤ
A.43,200á12֡
եårefresh˴ֳ֤ꤵ줿֤Ǥ롣

(1)SOAStart Of Authority
˴ؤ

(2)AAddress
ns1.network-exam.comȤNSʥ͡ॵСˤIPɥ쥹192.168.1.5˻ꤷwww.network-exam.comȤWWWWebСˤΤIPɥ쥹192.168.1.20˻ꤹϰʲǤ롣
ns1   IN A   192.168.1.5
www   IN A   192.168.1.20

INinternetΰ̣餷̤ʰ̣ʤƤ餺̵Ƥ⤤Ϥ

ޤϰʲΤ褦FQDNǽ񤤤Ƥɤɥᥤϴnamed.confˤƻꤷƤ뤫嵭Τ褦ʾάŪǤ롣
ns1.network-exam.com.   IN A   192.168.1.5
www.network-exam.com.   IN A   192.168.1.20
ǡns1.network-exam.com.פκǸΡ.פ̵ȡưŪˡnetwork-exam.comפͿΤǡns1.network-exam.com.network-exam.comפˤʤäƤޤ

(3)MXMail eXchanger
ǤϡDNSˤơŻҥ᡼Ѥ꥽쥳ɤϤɤ줫H20NW42ˡפȤ䤬ä
MX쥳ɤǤ롣ˤMXNSPTRSOA4ĤʤäMXºݤˤA쥳ɤ⻲ȤƤϤǤ롣
᡼륵ФꤹˤϡMX쥳ɤA쥳ɤ2ĤɬפǤMX쥳ɤľIPɥ쥹񤤤Ƥ⡢ޤư뤳Ȥ¿ȤϻפޤRFCΥ롼ǤFQDNǽ񤯤褦˷ޤäƤꡢIPɥ쥹ǵܤʤ⤢ޤ
  MX쥳
    IN MX 10 mx1.network-exam.com.
    IN MX 20 mx2.network-exam.com.
  ͥ٤򺹤ͥ褵롣ξ10ͥ

 A쥳
mx1    IN A   192.168.1.11
mx2    IN A   192.168.1.12
ºݤưȤƤϡMX쥳ɤIPɥ쥹ľܵܤƤưϤ롣

(4)NSName Server

(5)PTRPoinTR

(6)CNAMECanonical NAME

(7)TXT
TXT쥳ɤǤդʸ򵭺ܤǤޤ褯ѤȤơSPFεҤޤ
http://sc.seeeko.com/archives/3809455.html
SPFǡ᡼륵Фꤹ뤳Ȥǡ᡼κΤȽǤޤ

ޤǤդʸ򵭺ܤǤΤǡ¾Υ쥳ɤ٤ơʸ󤬵ܤƤǽޤDNSAMPǤϡλȤߤѤޤ褦ϡΤԹ礬ΤǤ
http://sc.seeeko.com/archives/4562656.html

ޤTXT쥳ɤ˹⤢ޤ
H29SC孶2ˤǤϡOSǻꤵ줿DNSФФơޥ륦ݻ줿FQDNƤTXT쥳ɤ䤤碌줿ʸȤƲᤷưפȤޤ

DNS򿼤뤿ˡºݤ˼ʬǥޥɤ¹ԤƤߤޤ礦

ޥɥץץȤʲΤ褦˼¹ԤƤ

c:\>nslookupDNS̾򤹤륳ޥ
ΥС:  xxx.xxx¸DNS
Address:  192.168.179.1

> www.ipa.go.jp 褷FQDN
С:  xxx.xxx
Address:  192.168.179.1

¤Τʤ:åDNSФƤ뤿
̾:    www.ipa.go.jp
Address:  202.122.141.45IPAIPɥ쥹

> set type=allƤξߤ뤿
> ipa.go.jp
С:  xxx.xxx
Address:  192.168.179.1

¤Τʤ:
ipa.go.jp       MX preference = 20, mail exchanger = ipa-sfw2.ipa.go.jp
ipa.go.jp       MX preference = 10, mail exchanger = ipa-sfw1.ipa.go.jp
ipa.go.jp       text =

        "MS=ms80859861"
ipa.go.jp       text =

        "v=spf1 mx ip4:192.218.88.1 ip4:192.218.88.4 ip4:192.218.88.231 ip4:202.
176.10.23 ip4:202.229.63.234 ip4:202.229.63.238 ip4:202.229.63.243 ip4:210.168.4
5.67 ip4:133.163.199.192/28 -all"
ipa.go.jp
        primary name server = ipa-ns.ipa.go.jp
        responsible mail addr = postmaster.ipa.go.jp
        serial  = 2018111301
        refresh = 43200 (12 hours)
        retry   = 7200 (2 hours)
        expire  = 2419200 (28 days)
        default TTL = 10800 (3 hours)
ipa.go.jp       nameserver = ipa-ns2.ipa.go.jp
ipa.go.jp       nameserver = ipa-ns.ipa.go.jp
ipa.go.jp       nameserver = dns-a.iij.ad.jp

ipa-sfw1.ipa.go.jp      internet address = 192.218.88.2
ipa-sfw2.ipa.go.jp      internet address = 202.229.63.236
ipa-ns.ipa.go.jp        internet address = 192.218.88.1
ipa-ns2.ipa.go.jp       internet address = 202.229.63.234
>

> set type=MX᡼륵Ф
> ipa.go.jp
С:  aterm.me
Address:  192.168.179.1

¤Τʤ:
ipa.go.jp       MX preference = 10, mail exchanger = ipa-sfw1.ipa.go.jp
ipa.go.jp       MX preference = 20, mail exchanger = ipa-sfw2.ipa.go.jp

ipa.go.jp       nameserver = ipa-ns.ipa.go.jp
ipa.go.jp       nameserver = dns-a.iij.ad.jp
ipa.go.jp       nameserver = ipa-ns2.ipa.go.jp
ipa-sfw1.ipa.go.jp      internet address = 192.218.88.2
ipa-sfw2.ipa.go.jp      internet address = 202.229.63.236
ipa-ns.ipa.go.jp        internet address = 192.218.88.1
ipa-ns2.ipa.go.jp       internet address = 202.229.63.234

> server ipa-ns.ipa.go.jpҥСĤޤIPADNSСNSˤѹ
ΥС:  ipa-ns.ipa.go.jp
Address:  192.218.88.1

> set type=AA쥳ɤ
> www.ipa.go.jp
С:  ipa-ns.ipa.go.jp
Address:  192.218.88.1

̾:    www.ipa.go.jp٤ϸҤ̵ȽФʤ
Address:  202.122.141.45

> server 8.8.8.8ǰΤᡢGoogleDNSꤷƤߤ롣
ΥС:  [8.8.8.8]
Address:  8.8.8.8

> www.ipa.go.jp
С:  [8.8.8.8]
Address:  8.8.8.8

¤Τʤ:äѤꡢҤ̵ȽФ
̾:    www.ipa.go.jp
Address:  202.122.141.45

DNS̾ˡˤϡֺƵ䤤碌פȡȿ䤤碌פ2ब롣
Ƶ䤤碌
饤ȤΥ꥾Ф顢DNSФФ䤤碌򤹤롣ƵŪȤդϡֺƤӵäƤס̤ʬˤʬʤˤ䤤碌򤷤̤äƤ롣
ݥȤϡǽŪʲ򤹤뤳ȡ

ȿ䤤碌H22SCո孶1ˤǤϡƵŪ礻פȤɽȤޤ
롼ȥ͡ॵФ䤤碌롣ޤˤ褦ˡ٤ȿפƤ롣
ȤСy-sya.example.co.jpξ
13椢롼ȥ͡ॵФ䤤碌롼ȥ͡ॵФ.jpɥᥤΥФ򶵤롣
jpɥᥤΥФ䤤碌롼ȥ͡ॵФco.jpɥᥤΥФ򶵤롣
Ʊͤexample.co.jp
Ʊͤy-sya.example.co.jp
Τ褦ˤy-sya.example.co.jpDNSФãDNS̾򤷤Ƥ餦
ǤDNSΤư˴ؤơ֥󥿡ͥåȾDNSФϳزƤꡢ̾Фƾ󤬤ʤˤϡ̤DNSФ䤤碌פȤ롣H21NW9)

˥եؤž
եˤơ¾DNSФ˰ꤹ롣ϡDNSեΡforwarders˻ꤹ롣ȤСDNSФץХDNSФեȤꤹ롣DNS䤤碌ϥեǤ롣䤤碌̤ϡեPCľ֤ΤǤϤʤʬΤäƤΤ褦֤
dns
Ƶ䤤碌ξϡǽŪʲy-sya.example.co.jpФIPɥ쥹ˤ򤹤롣ȿ䤤碌ϡǽŪʲȤϸ¤餺˻Ȥ٤DNSФҲ𤷤Ƥ롣
1
Ǥ⡢ޤμDNSФ롼ȥ͡ॵФˤϡ
.jpΥ͡ॵФIPɥ쥹䤤碌Ƥޤ͡
ơ.jpΥ͡ॵФIP֤ƤΤǡ켫ΤϺǽŪʲǤϤʤΤǤ
䡣y-sya.example.co.jpפϡȤ䤤碌򤷤Ƥ롣ǽ㤤åäƤƲƤ⤢뤫͡
5
ǤϡեϤɤʬवޤ
ȿ䤤碌ǤϤʤΤǡƵ䤤碌Ǥ͡
䡢ɤǤʤեɤñDNS䤤碌žƤ


WindowsDNSФǡֺƵ̵ˤʥե̵ˤʤޤˡפȤåܥå롣Ƶ䤤碌򤷤ʤΤǡեˤ䤤碌⤷ʤȤȤ

ۤɤΥե1ܤTTLä
$TTL 86400 ;1
ϡDNSξü֤ͭǤ롣üǤäơDNSФǤϤʤϤ

ºݤ˥ѥdzǧƤߤ褦
äDNS򥭥å򥯥ꥢ롣ʤʤƤ⤤ꥢۤ狼䤹
C:\>ipconfig /flushdns
Windows IP
DNS ꥾С å˥եå夵ޤ

ȤСGoogle˥롣ȡʤDNSФ򻲾ȤGoogleIPɥ쥹İơIPɥ쥹GoogleWebȤ˥롣DNSФ䤤碌ƤΨʤΤǡѥ¦DNSΥåġTime To LiveȤơ130ôDNSΥåͭƤȤ̣Ǥ롣
C:>ipconfig /displaydns

Windows IP

www.google.co.jp
----------------------------------------
쥳̾ . . . . . : www.google.co.jp
쥳ɤμ . . . : 1
Time To Live . . . .: 130
ǡĹ . . . . : 4
. . . . . . . :
A (ۥ) 쥳. . . : 74.125.235.88
쥳̾ . . . . . : www.google.co.jp
쥳ɤμ . . . : 1
Time To Live . . . .: 130
ǡĹ . . . . : 4
. . . . . . . :
A (ۥ) 쥳. . . : 74.125.235.95
Ĥ

TTLĹȡ̵̤DNS䤤碌ʤʤ롣Ǥ⡢DNS󤬹Ƥ⡢ȿǤ٤ʤȤǥåȤ⤢ޤ͡
äơWebФIPɥ쥹ѹʤɤϡTTL5äʤɤûͤˤ롣ƤСPC¦DNSΥå5äʤʤΤǡŤåˤäơФ˥ǤʤʤɤԶ礬ʤʤ롣


ݥ󥵡ɥ

ΥڡΥȥåץ