replication between primary & secondary bind servers in linux?

Bill Larson wllarso at swcp.com
Wed Feb 7 16:58:03 UTC 2001


A little rant on my part to follow, please forgive me.

Computer security, as defined in "Practical Unix Security" by Simon
Garfinkel and Gene Spafford, includes the following points:

	Privacy - protectiong information from being read
	Data integrity - Protecting information from being altered
	Availability - Protecting your services to insure that they can be used
	Consistency - Insuring that your system behave as expected
	Isolation - Controlling access to your systems
	Audit - Tracking changes to your systems

In terms of providing DNS service, the two most critical areas of
security should be "data integrity" and "availability".  If the DNS
information you provide isn't available, then you don't have a "secure"
system.  Information "privacy" for a public service such as DNS should
not be a high priority!

Providing DNS information and services to the Internet cannot be viewed
in a parochial manner manner.  Your responsibility is to both your
users and the Internet as a whole.

Do NOT limit your thinking to "I've got mine!"  The Internet was
originally developed based upon both rights and responsibilities.  You
have the right to do what you want, but you also have the responsibilty
to limit the impact of your actions.  One of your responsibilities
when providing DNS information is to insure the availability of this
information at all times, not just to your users but to the Internet
community itself.

Find an organization that can assist you in providing a site for
secondary DNS information.  Quite often this is your ISP, which
unfortunately doesn't limit the impact of an Internet outage to your
ISP, but at least it can limit the impact to your Internet connection.
You may also be able to find some organization that would be willing to
provide secondary DNS services for you as an exchange of services.
Check!

Finally, you can use any mechansim that you want to transfer name
server configuration information.  This can be NFS or FTP, whatever you
desire.  You can even script an FTP file transfer.  Use your "vtund" if
you are familiar with this.  Personally I would use the SSH scp,
"secure copy", but I'm most familar with it.  But, this is outside the
issue of configuring and running a BIND name server.

The security issue with transfer of zone file configuration is less of
"privacy" of the information itself (except for possibly TSIG keys)
than making sure that your connection password itself is exposed to the
world which could allow someone to modify your information without your
knowlege and permission.

In general, authentication sessions should be encrypted, but if the
data that is being transmitted isn't sensitive, such as a list of zones
that you are hosting, then encryption of the transmitted data itself
isn't extremely critical.

Bill Larson

> I never actually thought about SMTP...  Anyway at this point it isn't
> possible to separate the servers but in a few months we will probably be
> adding a new location, so I should be able to impliment it then.  So now I
> should be thinking more about security.  Since these are both linux boxes, I
> was thinking I could use vtund (a prog that I use to create encryped tunnels
> on the net) and copy the files that way.  I still think there should be a
> better way to copy it than NFS (over the tunnel of course), but I can't
> think of any.  Is there a way I could do a script with FTP to get a file?
> Any ideas?


More information about the bind-users mailing list