<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On Apr 7, 2009, at 9:43 AM, Chandan Laskar wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><font size="2" face="sans-serif">Hi,</font> <br><font size="2" face="sans-serif">We have deployed DNS on RHEL 5 Update 1. Below are feature of our DNS.</font> <br> <br><font size="2" face="sans-serif"><b>1. Implemented OS Security Best Practice ( e.g. Enable MD5 and shadow passwords, Root Login Console Restricted, Configure SSH as an alternative of Telnet e.t.c.). </b></font> <br><font size="2" face="sans-serif"><b>2. Configured Openssl Version 0.9.8j.</b></font> <br><font size="2" face="sans-serif"><b>3. Configured BIND 9.6.0-P1 with CHROOT Environment. So BIND is not running as root user.</b></font> <br><font size="2" face="sans-serif"><b>4. IPTABLES has been configured to block all the irrelevant ports.<br> 5. Allow Update Feature in named.conf is not changed. So, by default it is 'NO'</b></font> <br><font size="2" face="sans-serif"><b> </b></font> <br><font size="2" face="sans-serif"><b>After all the above mentioned protection do we really need to incorporate DNSSEC Lookaside Validation(DLV) in our DNS?</b></font> <br> <br><font size="2" face="sans-serif">Suggestion Please.</font> </blockquote><br></div><div>Your implementation is protecting the DNS server itself - very good. The purpose of DLV is to insure that the DNS data that your server provides, and all DNSSEC data your server processes, is valid. </div><div><br></div><div>The DNSSEC/DLV configuration protects your DNS data from being "spoofed" on another DNS server. It also insures that the DNS data that your server may be handing out recursively from being compromised. Protecting both sides of the DNS service for your users is necessary (at least important).</div></body></html>