mirror of
https://github.com/internetstandards/toolbox-wiki.git
synced 2026-07-21 11:37:40 +02:00
Update toolbox wiki to 2026 releases, initial commit
This commit is contained in:
Wouter Kobes
@@ -0,0 +1,48 @@
|
||||
This document lists the basic usage of commonly used DNS records. It can be used to track commonly made mistakes.
|
||||
|
||||
# A
|
||||
* Points to an IPv4 address.
|
||||
* Does not point to anything else.
|
||||
* Record does not start (left side) with _ or -.
|
||||
|
||||
# AAAA
|
||||
* Points to an IPv6 address.
|
||||
* Does not point to anyhting else.
|
||||
* Record does not start (left side) with _ or -.
|
||||
|
||||
# MX
|
||||
* Used to specify a mailserver.
|
||||
* Contains a hostname, which in turn points to one or multiple A and/or AAAA records.
|
||||
* Preferrably does not point to other record types, but the use of CNAME records is seen in practice. RFC's are inconsistent on this.
|
||||
* Has a priority value.
|
||||
|
||||
# CNAME
|
||||
* Redirects to other DNS name with its own records (A, AAAA, CNAME).
|
||||
* Be careful with CNAME chaining; don't use too many CNAMEs in a row.
|
||||
|
||||
# CAA
|
||||
* Used to allowlist Certification Authorities that may issue certificates.
|
||||
* May contain several policies, like issue, issuewild (wildcard), issuemail (S/MIME certificates) and issuevmc (BIMI certificates).
|
||||
|
||||
# SRV
|
||||
* Records starts (left side) with _.
|
||||
* Points to an A and/or AAAA record.
|
||||
* Has a priority value.
|
||||
|
||||
# NS
|
||||
* Used to specify a nameserver.
|
||||
* Contains a hostname, which in turn points tp one or multiple A and/or AAAA records.
|
||||
|
||||
# SOA
|
||||
* Mandatory for every DNS zone.
|
||||
* Contains the following information (seperated by a single white space):
|
||||
* FQDN of the primary name server followed by a trailing dot.
|
||||
* e-mail address of the DNS administrator (followed by a trailing dot, the @ replaced with a dot and other dots escaped using a backslash).
|
||||
* an opening round bracket "(".
|
||||
* serial number that is changed (increased) on every zone change.
|
||||
* refresh time (in seconds) for a secondary name server to check the primairy name server for changes in the zone.
|
||||
* retry time (in seconds) for a secondary name server for requesting the serial number when the primary name server did not respond on the previous request.
|
||||
* expire time (in seconds) after which a secondary name server should stop answering requests if the primary name server is not responding.
|
||||
* Negative caching time to live (in seconds) which is the time a caching name server should cache a negative result (indicating that a name does not exist) coming from the authorative name server before trying again.
|
||||
* a closing round bracket ")".
|
||||
|
||||
@@ -0,0 +1,100 @@
|
||||
<img align="right" src="/images/logo-internetnl-en.svg">
|
||||
|
||||
# Ngnix example configuration
|
||||
This example configuration was created by SIDN Labs and shows how to configure Ngnix in order to score 100% in the Website test on Internet.nl.
|
||||
|
||||
# Assumptions
|
||||
* DNSSEC is used
|
||||
* IPv6 is used
|
||||
|
||||
# Configuring Ngnix
|
||||
|
||||
server_tokens off;
|
||||
add_header X-Frame-Options SAMEORIGIN;
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
add_header Strict-Transport-Security "max-age=31536000" always;
|
||||
add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'" always;
|
||||
add_header Referrer-Policy "strict-origin" always;
|
||||
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/example.nl/fullchain.pem;
|
||||
|
||||
# Rate limiting 20 requests/s
|
||||
limit_req_zone $binary_remote_addr zone=mylimit:10m rate=20r/s;
|
||||
|
||||
# http://example.nl -> https://example.nl
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name example.nl;
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://example.nl$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
# http://(www|api).example.nl -> https://(www|api).example.nl
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name www.example.nl api.example.nl;
|
||||
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# https://example.nl -> https://www.example.nl
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name example.nl;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/example.nl/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/example.nl/privkey.pem;
|
||||
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_tickets on;
|
||||
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
return 301 https://www.$host$request_uri;
|
||||
}
|
||||
|
||||
# serve https://(www|api).example.nl
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name www.example.nl api.example.nl;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/example.nl/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/example.nl/privkey.pem;
|
||||
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_tickets on;
|
||||
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
# Example location for a Flask application running on port 8080
|
||||
location / {
|
||||
limit_req zone=mylimit burst=100 nodelay;
|
||||
|
||||
include uwsgi_params;
|
||||
uwsgi_pass flask:8080;
|
||||
uwsgi_ignore_client_abort on;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
<img align="right" src="/images/logo-internetnl-en.svg">
|
||||
|
||||
# UNDER CONSTRUCTION!!!
|
||||
|
||||
# STARTTLS how-to
|
||||
This how-to is created by the Dutch Internet Standards Platform (the organization behind [internet.nl](https://internet.nl)) and is meant to provide practical information and guidance on implementing STARTTLS.
|
||||
|
||||
# Table of contents
|
||||
Under construction
|
||||
|
||||
# What is STARTTLS?
|
||||
Under construction
|
||||
|
||||
# Why use STARTTLS?
|
||||
Under construction
|
||||
|
||||
# Tips, tricks and notices for implementation
|
||||
* http://postfix.1071664.n5.nabble.com/Disable-SSL-TLS-renegotiation-td96864.html#a96871
|
||||
* Use the RFC 7919 defined DH groups: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem)
|
||||
|
||||
## Implementing STARTTLS in Postfix
|
||||
**Specifics for this setup**
|
||||
* Linux Debian 10 (Buster)
|
||||
* Postfix 3.4.5
|
||||
* OpenSSL 1.1.1d
|
||||
|
||||
**Assumptions**
|
||||
* Mail server is using DANE
|
||||
* Software packages are already installed
|
||||
|
||||
### Configuring Postfix
|
||||
|
||||
# use DANE (when acting as a client)
|
||||
smtp_dns_support_level = dnssec
|
||||
smtp_tls_security_level = dane
|
||||
smtp_host_lookup = dns
|
||||
smtp_tls_note_starttls_offer = yes
|
||||
|
||||
# --- TLS settings ---
|
||||
smtpd_tls_security_level = may
|
||||
smtpd_tls_key_file = /etc/postfix/ssl/example.nl.key
|
||||
smtpd_tls_cert_file = /etc/postfix/ssl/example.nl.crt
|
||||
smtpd_tls_CAfile = /etc/postfix/ssl/example.nl-cabundle.crt
|
||||
smtpd_tls_received_header = yes
|
||||
smtpd_tls_session_cache_timeout = 3600s
|
||||
|
||||
# --- TLS protocol config ---
|
||||
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
||||
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
||||
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
||||
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
||||
lmtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
||||
lmtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
||||
|
||||
# --- TLS cipher config ---
|
||||
smtpd_tls_mandatory_ciphers=high
|
||||
smtpd_tls_ciphers=high
|
||||
# disable compression and client-initiated renegotiation
|
||||
tls_ssl_options = NO_COMPRESSION, 0x40000000
|
||||
# disable unsecure ciphers
|
||||
smtpd_tls_exclude_ciphers = EXP, LOW, MEDIUM, aNULL, eNULL, SRP, PSK, kDH, ADH, AECDH, kRSA, DSS, RC4, DES, IDEA, SEED, ARIA, AESCCM8, 3DES, MD5
|
||||
smtp_tls_exclude_ciphers = EXP, LOW, MEDIUM, aNULL, eNULL, SRP, PSK, kDH, ADH, AECDH, kRSA, DSS, RC4, DES, IDEA, SEED, ARIA, AESCCM8, 3DES, MD5
|
||||
# Enable server cipher-suite preferences
|
||||
tls_preempt_cipherlist = yes
|
||||
# Forward secrecy
|
||||
smtpd_tls_eecdh_grade=ultra
|
||||
smtpd_tls_dh1024_param_file = /etc/postfix/ssl/ffdhe4096.pem
|
||||
|
||||
# --- TLS logging ---
|
||||
smtp_tls_loglevel = 1
|
||||
smtpd_tls_loglevel = 1
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user