{"id":34921,"date":"2019-10-31T22:01:17","date_gmt":"2019-10-31T19:01:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas\/"},"modified":"2019-10-31T22:01:17","modified_gmt":"2019-10-31T19:01:17","slug":"est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","title":{"rendered":"On arvamus, et tehnoloogia DANE brauseridest ei olnud edukas.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

R\u00e4\u00e4gime, mida kujutab endast DANE tehnoloogia domeeninimede autentimiseks DNS-i kaudu ja miks see pole brauserites laialdaselt levinud.<\/p>\n

\"On<\/a><\/noindex><\/a><\/noindex>
\n\/ Unsplash \/ Paulius Dragunas<\/a><\/noindex><\/i><\/p>\n

Mis on DANE<\/h2>\n

\nT\u00f5enduskeskused (CA) on organisatsioonid, mis juba kulutanud<\/a><\/noindex> kr\u00fcptograafilise t\u00f5endi SSL-sertifikaadid<\/a><\/noindex>. Nad lisavad sellele oma elektronallkirja, kinnitades selle ehtsuse. Siiski v\u00f5ivad tekkida olukorrad, kus t\u00f5endid antakse v\u00e4lja rikkumistega. N\u00e4iteks eelmisel aastal algatas Google \"usalduskaotamise protseduuri\" Symantec'i sertifikaatide suhtes nende kompromiteerimise t\u00f5ttu (sellest loost oleme r\u00e4\u00e4kinud meie blogis \u2014 \u00fcks<\/a><\/noindex> ja kaks<\/a><\/noindex>).<\/p>\n

Kuna selliste olukordade v\u00e4ltimiseks, t\u00f6\u00f6tati paar aastat tagasi IETF-is v\u00e4lja<\/a><\/noindex> DANE tehnoloogia (aga see pole brauserites laialdaselt levinud \u2014 r\u00e4\u00e4gime hiljem, miks see nii on).<\/p>\n

DANE (DNS-i p\u00f5hine autentimine nimelistele \u00fcksustele) on spetsifikatsioonide kogum, mis v\u00f5imaldab kasutada DNSSEC-d (Nime s\u00fcsteemi turvapikendused) SSL-sertifikaatide \u00f5igusp\u00e4rasuse kontrollimiseks. DNSSEC on domeeninime s\u00fcsteemi t\u00e4iendav turvaparandus, mis minimeerib aadresside asendamisega seotud r\u00fcnnakud. Kasutades neid kahte tehnoloogiat, saavad veebihaldurid v\u00f5i kliendid p\u00f6\u00f6rduda \u00fche DNS-ala operaatori poole ja kinnitada kasutatava sertifikaadi kehtivust.<\/p>\n

P\u00f5him\u00f5tteliselt toimib DANE iseenesekirjutatud sertifikaadina (selle usaldusv\u00e4\u00e4rsuse tagajana on DNSSEC) ja t\u00e4iendab CA funktsioone.<\/p>\n

Kuidas see t\u00f6\u00f6tab<\/h2>\n

\nDANE spetsifikatsioon on kirjeldatud RFC6698<\/a><\/noindex>. Vastavalt dokumendile on DNS-i ressursi kirjad<\/a><\/noindex> t\u00e4iendatud uue t\u00fc\u00fcbi \u2014 TLSA. See sisaldab teavet edastatava sertifikaadi, andmete suuruse ja t\u00fc\u00fcbi ning andmete enda kohta. Veebihaldur loob sertifikaadi digitaalallkirja, allkirjastab selle DNSSEC-i kaudu ja lisab selle TLSA-sse.<\/p>\n

Klient \u00fchendub interneti veebisaidiga ja v\u00f5rrelda selle sertifikaati DNS-operaatorilt saadud \"koopia\"-ga. Kui need kattuvad, peetakse ressurssi usaldusv\u00e4\u00e4rseks.<\/p><\/blockquote>\n

\nDANE wiki-lehelt leiate j\u00e4rgmise n\u00e4ite DNS-i p\u00e4ringust serverile example.org TCP-pordialal 443:<\/p>\n

IN TLSA _443._tcp.example.org<\/code><\/pre>\n
\nVastus n\u00e4eb v\u00e4lja j\u00e4rgmine:<\/p>\n
 _443._tcp.example.com. IN TLSA (\n   3 0 0 30820307308201efa003020102020... )\n<\/code><\/pre>\n
\nDANE-l on mitmeid laiendusi, mis t\u00f6\u00f6tavad koos teiste DNS-kirjadega peale TLSA. Esimene on DNS-kiri SSHFP SSH-\u00fchenduste v\u00f5tmete kontrollimiseks. See on kirjeldatud RFC4255<\/a><\/noindex>,\u00a0RFC6594<\/a><\/noindex>\u00a0ja\u00a0RFC7479<\/a><\/noindex>. Teine \u2014 OPENPGPKEY salvestus, mis v\u00f5imaldab v\u00f5tmete vahetamist PGP abil (RFC7929<\/a><\/noindex>). L\u00f5puks kolmas \u2014 SMIMEA salvestus (RFCs pole veel ametlikku standardit, on olemas ainult selle mustand<\/a><\/noindex>) kr\u00fcptograafiliste v\u00f5tmete vahetamiseks S\/MIME kaudu.<\/p>\n
Mis on DANE probleem<\/h2>\n
\nMais toimus DNS-OARC konverents (see on mittetulundus\u00fching, mis tegeleb domeeninime s\u00fcsteemi turvalisuse, stabiilsuse ja arengu k\u00fcsimustega). \u00dchel paneelil j\u00f5udsid eksperdid j\u00e4reldusele<\/a><\/noindex>, et DANE tehnoloogia on brauserites eba\u00f5nnestunud (v\u00e4hemalt praeguses teostuses). Konverentsil viibinud Geoff Huston, juhtiv teaduskaast\u00f6\u00f6taja APNIC<\/a><\/noindex>, \u00fchel viiest piirkondlikust interneti registrist, kirjeldas<\/a><\/noindex> DANE'i kui \u201esurnud tehnoloogiat.\u201c<\/p>\n
Populaarsed brauserid ei toeta DANE abil sertifikaatide autentimist. Turul esinevad spetsiaalsed lisandmoodulid<\/a><\/noindex>, mis avavad TLSA salvestiste funktsionaalsuse, kuid isegi nende toetust lakkavad j\u00e4rk-j\u00e4rgult<\/a><\/noindex>.<\/p><\/blockquote>\n
\nDANE\u2019i leviku probleemid brauserites seostatakse DNSSEC-i valideerimisprotsessi pikkade kestvustega. S\u00fcsteem peab SSL-sertifikaadi ehtsuse kinnitamiseks l\u00e4bima kr\u00fcptograafilisi arvutusi ja minema l\u00e4bi k\u00f5ikide DNS-serverite ketist (kuni juure tsoonist hosti domeenini) esmakordsel ressursile \u00fchendamisel.<\/p>\n
\"On
\n\/ Unsplash \/ Kaley Dykstra<\/a><\/noindex><\/i><\/p>\n
Seda puudust \u00fcritati Mozilla kaudu lahendada DNSSEC Chain Extension<\/a><\/noindex> TLS jaoks. See pidi v\u00e4hendama DNS-salvestuste arvu, mida klient pidi autentimise ajal vaatama. K\u00fcll aga tekkis arendajate r\u00fchmas lahknevus, mida ei \u00f5nnestunud lahendada. L\u00f5puks j\u00e4eti projekt h\u00fcljatuks, kuigi IETF kiitis selle m\u00e4rtsis 2018.<\/p>\n
Teiseks DANE'i madala populaarsuse p\u00f5hjuseks peetakse DNSSEC'i n\u00f5rgalt levinud k\u00fcpsetajat maailmas \u2014 ainult 19% ressurssidest t\u00f6\u00f6tab sellega.<\/a><\/noindex>. Eksperdid arvasid, et see ei ole piisav DANE'i aktiivseks edendamiseks.<\/p>\n
T\u00f5en\u00e4oliselt areneb t\u00f6\u00f6stus teises suunas. Selle asemel, et kasutada DNS-i SSL\/TLS sertifikaatide kontrollimiseks, kavatsevad turuosalised hoopis edendada protokolle DNS-over-TLS (DoT) ja DNS-over-HTTPS (DoH). Viimast mainisime \u00fches meie eelnevas materjalis<\/a><\/noindex> Habras. Nad nad murreteerivad ja kontrollivad kasutajate p\u00e4ringuid DNS-serverile, v\u00e4ltides sellega pahatahtlike isikute v\u00f5imalust andmeid vale kujul esitada. Aasta alguses oli DoT juba rakendusteadlikud v\u00f5rgud ja \u00fcks Ameerika \u00dchendriikide kohalikest pilveteenuse pakkujatest.<\/a><\/noindex> Google'i jaoks oma Public DNS-i. Mis puudutab DANE'i - kas tehnoloogia suudab 'selga tagasi t\u00f5usta' ja muutuda populaarsuseks, seda n\u00e4eme tulevikus.<\/p>\n
Mida veel meilt leida lisalugemiseks:<\/b><\/p>\n
\"On Kuidas automatiseerida IT-infrastruktuuri haldamist \u2014 arutame kolme suundumust<\/a><\/noindex>
\n\"On JMAP - avatud protokoll asendab IMAP'i e-kirjade vahetamisel<\/a><\/noindex><\/p>\n
\"On Kuidas s\u00e4\u00e4sta rakenduste programmeerimise liidese abil<\/a><\/noindex>
\n\"On DevOps pilveteenuses n\u00e4itel 1cloud.ru<\/a><\/noindex>
\n\"On Pilve arhitektuuri evolutsioon 1cloud<\/a><\/noindex><\/p>\n
\"On Kuidas t\u00f6\u00f6tab 1cloudi tehniline tugi<\/a><\/noindex>
\n\"On M\u00fc\u00fcdid pilvetehnoloogiate kohta<\/a><\/noindex><\/p><\/blockquote>\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0413\u043e\u0432\u043e\u0440\u0438\u043c \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0435\u043d \u043f\u043e DNS \u0438 \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0430 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445. \/ Unsplash \/ Paulius Dragunas \u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 DANE \u0421\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0446\u0435\u043d\u0442\u0440\u044b (CA) \u2014 \u044d\u0442\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0442\u0441\u044f \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u0435\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 SSL-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u041e\u043d\u0438 \u0441\u0442\u0430\u0432\u044f\u0442 \u043d\u0430 \u043d\u0438\u0445 \u0441\u0432\u043e\u044e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u044c. \u041e\u0434\u043d\u0430\u043a\u043e \u043f\u043e\u0440\u043e\u0439 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0442 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26289,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34921","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47On arvamus: tehnoloogia DANE brauserite jaoks on eba\u00f5nnestunud | ProHoster","description":"R\u00e4\u00e4gime, mida kujutab endast DANE tehnoloogia domeeninimede autentimiseks DNS-i kaudu ja miks see pole brauserites laialdaselt levinud.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0415\u0441\u0442\u044c \u043c\u043d\u0435\u043d\u0438\u0435: \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0430\u043b\u0438\u043b\u0430\u0441\u044c | ProHoster","og:description":"\u0413\u043e\u0432\u043e\u0440\u0438\u043c \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0435\u043d \u043f\u043e DNS \u0438 \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0430 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:01:17+00:00","article:modified_time":"2019-10-31T19:01:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34921","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 21:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:12:28","updated":"2026-01-21 21:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/34921","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=34921"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/34921\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/26289"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=34921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=34921"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=34921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}