<div dir="ltr">Correct on the gist. All answers where extremely helpful. I am curious on <span style="font-size:12.8px;font-weight:bold;white-space:nowrap">Vinícius Ferrão</span> query I would like it to be more secure. I'll have to read more on using <span style="font-size:12.8px">GSS-TSIG with Kerberos. I seem to recall this is setup by the samba install of AD but I'll have to look at it more closely as now I want to setup a slave DNS to the AD's DNS. I too will probably have the same issue as </span><span style="font-size:12.8px;font-weight:bold;white-space:nowrap">Vinícius Ferrão</span><span style="font-size:12.8px">.</span><div><span style="font-size:12.8px">Is the only good option for now to leave my server mostly open with accepting from an ip which can be spoofed (I'm just doing this on a computer that is unlikely to get hacked with a spoof) but I would like something that I could take to business security. The only domains I have vulnerable are just a few test ones that I can rebuild in a heartbeat.</span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jul 28, 2016 at 1:40 PM, Darcy Kevin (FCA) <span dir="ltr"><<a href="mailto:kevin.darcy@fcagroup.com" target="_blank">kevin.darcy@fcagroup.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">Yes, I did misread the original post; thanks for clarifying.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">But, the gist of the question seemed to be about mitigating the effects of caching, for dynamically-changing data. At a high level, whether the zones are AD zones
or not, whether the “master” is BIND or Microsoft DNS, doesn’t have a whole lot of bearing on that challenge. As should be obvious from what I proposed, I prefer the slaving+NOTIFY approach over setting up fragile forwarding arrangements.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">The other sledgehammer approach, of course, is to set the TTLs really low, but that can have a disastrous effect on performance/capacity, according to how frequently
the dynamically-changing names are being queried. Of course, no amount of named.conf tweaking will help to mitigate the effects of caching that occurs on the clients themselves (e.g. “nscd” on some *nix platforms, Windows resolver cache for Windows). The only
standards-based solution for that is to lower the TTLs. (Non-standards-based solutions include ugly stuff like running a script on every client to flush the cache every minute, ugh). But, as always, lowering TTLs, should be done, if at all, with one’s eyes
open to the performance/capacity impact.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">
- Kevin<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:black"><u></u> <u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><img width="131" height="48" src="cid:image001.jpg@01D1E8DB.6D4957A0" alt="FCA_Pantone_email"></span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><u></u><u></u></span></p><span class="">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">----------------------------------------------------------------------<u></u><u></u></span></b></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial Black","sans-serif";color:black">Kevin Darcy</span><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black"><br>
NAFTA Information Security Projects</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial Black","sans-serif";color:black">FCA US LLC<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">1075 W Entrance Dr,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">Auburn Hills, MI 48326<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">USA<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">Telephone: <a href="tel:%2B1%20%28248%29%20838-6601" value="+12488386601" target="_blank">+1 (248) 838-6601</a>
<br>
Mobile: <a href="tel:%2B1%20%28810%29%20397-0103" value="+18103970103" target="_blank">+1 (810) 397-0103</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">Email: <a href="mailto:kevin.darcy@fcagroup.com" target="_blank">kevin.darcy@fcagroup.com</a><u></u><u></u></span></p>
</span></div>
<p class="MsoNormal"><span style="color:black"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Chris Buxton [mailto:<a href="mailto:clists@buxtonfamily.us" target="_blank">clists@buxtonfamily.us</a>]
<br>
<b>Sent:</b> Thursday, July 28, 2016 12:52 PM<br>
<b>To:</b> Darcy Kevin (FCA)<br>
<b>Cc:</b> <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a></span></p><div><div class="h5"><br>
<b>Subject:</b> Re: Multiple AD domains<u></u><u></u></div></div><p></p>
</div>
</div><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">The OP's question was about setting up BIND, not MS DNS, related to using Samba, not Windows, as the domain controller.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Regards,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Chris<br>
<br>
Sent from my iPhone<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
On Jul 27, 2016, at 12:36 PM, Darcy Kevin (FCA) <<a href="mailto:kevin.darcy@fcagroup.com" target="_blank">kevin.darcy@fcagroup.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">My preference? Have all your clients use BIND to resolve DNS (this gives access to more advanced features like sortlisting, good query logging, blacklisting/redirection
through the RPZ mechanism, Anycast, etc.). Set up the BIND instances as slaves for the AD zones, and have the AD folks add the BIND instances to the apex NS records so that the DCs will trigger fast replication to BIND via the NOTIFY extension to the protocol.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">I’d never let a regular PC client use Microsoft DNS for resolving DNS. Perish the thought!</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">Note that this approach, if implemented simply, doesn’t scale to large numbers of BIND instances (because you don’t want to add dozens or hundreds of apex NS
records to the zone). Beyond a certain threshold, you’d want to set up a multi-level slaving/NOTIFY hierarchy on the BIND side…</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">
- Kevin</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:black"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:black"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><image001.jpg></span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">----------------------------------------------------------------------</span></b><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial Black","sans-serif";color:black">Kevin Darcy</span><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black"><br>
NAFTA Information Security Projects</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial Black","sans-serif";color:black">FCA US LLC</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">1075 W Entrance Dr,</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">Auburn Hills, MI 48326</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">USA</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">Telephone: <a href="tel:%2B1%20%28248%29%20838-6601" value="+12488386601" target="_blank">+1 (248) 838-6601</a>
<br>
Mobile: <a href="tel:%2B1%20%28810%29%20397-0103" value="+18103970103" target="_blank">+1 (810) 397-0103</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:black">Email:
<a href="mailto:kevin.darcy@fcagroup.com" target="_blank">kevin.darcy@fcagroup.com</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:black"> </span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> bind-users [<a href="mailto:bind-users-bounces@lists.isc.org" target="_blank">mailto:bind-users-bounces@lists.isc.org</a>]
<b>On Behalf Of </b>Jeff Sadowski<br>
<b>Sent:</b> Wednesday, July 27, 2016 3:00 PM<br>
<b>To:</b> <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<b>Subject:</b> Re: Multiple AD domains</span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">should I setup 192.168.1.1 as slaves to these two domains would that fix it?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">On Wed, Jul 27, 2016 at 12:56 PM, Jeff Sadowski <<a href="mailto:jeff.sadowski@gmail.com" target="_blank">jeff.sadowski@gmail.com</a>> wrote:<u></u><u></u></p>
<div>
<p class="MsoNormal">On the samba mailing list they described setting up the DC as the NS and forward to another machine for more rules.<u></u><u></u></p>
<div>
<p class="MsoNormal">This will work fine for one domain. Now lets say I have 2 domains.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">If I setup forwarders like so on 192.168.1.1<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">zone "domainA" IN { type forward; forward only; forwarders { 192.168.2.1; }; };<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">zone "domainB" IN { type forward; forward only; forwarders { 192.168.3.1; }; };<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">It will cache entries for each domain and if a computer gets a different address for dhcp it will update on the domain's DNS but the dns on 192.168.1.1 will have a cached entry untill it expires.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">192.168.2.1 and 192.168.3.1 are setup to forward all other zones than their domain names to 192.168.1.1<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">if I have DNS server set for all machines in domainA to 192.168.2.1 all machines on domainA see any DNS changes to domainA imediately machines on domainB are cached and can take time to clear out.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">And<u></u><u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">if I have DNS server set for all machines in domainB to 192.168.3.1 all machines on domainB see any DNS changes to domainB imediately machines on domainA are cached and can take time to clear out.<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">What is the best way to resolve this issue?<u></u><u></u></p>
</div>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
</blockquote>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><u></u><u></u></p>
</div>
</blockquote>
</div></div></div>
</div>
<br>_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br></blockquote></div><br></div>