<br><br><div class="gmail_quote">On Sun, Oct 18, 2009 at 3:50 PM, Barron, Josh <span dir="ltr"><<a href="mailto:jbarron@afsnetworks.com">jbarron@afsnetworks.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
I think I have it understood. I just setup the public DNS servers to replicate the stealth master DNS server; everything else is resolved at the database layer. The only vulnerability is that if my primary database is corrupted or compromised, the 4 public servers are instantly invalid.<br>
</blockquote><div><br>As it relates to a compromise, super master setups are similarly vulnerable.<br>The only difference is that if your master is compromised, the bad data will be pushed out to slaves via AXFR updates rather than db replication.<br>
Depending on how you're looking at the situation, it might be worth mentioning that a properly configured PDNS instance does not expose the database to public scrutiny . Therefore, in either scenario, an attacker must compromise PDNS itself.<br>
<br>As it relates to corruption: Using a super master setup will only save you if the corruption on the master actually prevents AXFR's from being trasmitted properly (e.g. on-disk file corruption etc). In that case your slaves will hum along happily with valid, if stale, data. In practice, most data "corruption" tends to be a result of an authorized operator accidentally issuing something along the lines of:<br>
DELETE FROM records; <br>In this situation there's little if any difference between the time periods when a db replicated setup vs. a super master setup will reflect the bad data.<br>Web frontends and transactions are the answer here.<br>
<br>The ultimate decision maker for me was the fact that PDNS won't perform AXFR updates to hosts that are not listed as NS hosts in the master DB. This made it (close to) impossible for me to use master-slave or super master configurations that push updates to reserved/VPN'd IP addresses.<br>
<br>While slightly counter-intuitive, native db replication is, in my opinion, the least complicated method for keeping multiple PDNS hosts in sync.<br><br> </div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>
Last question for now, do I do anything special with PDNS on the "public" name servers, or do I just set them up normally...<br></blockquote><div><br>This is fairly open ended but here's some thoughts for consideration:<br>
<br>- set your version-string to anonymouse<br>- ensure your pdns webserver is off, or protected by a firewall<br>- use chroot<br>- make sure you are not providing recusion to the entire internet (allow-recursion=<specific ip/nets>)<br>
- if you're using db replication you can disable-axfr=yes<br>- you should also be able to: disable-tcp=yes<br><br> </div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<font color="#888888"><br>
-Josh<br>
</font><div><div></div><div class="h5"><br>
<br>
-----Original Message-----<br>
From: Baird, Josh [mailto:<a href="mailto:jbaird@follett.com">jbaird@follett.com</a>]<br>
Sent: Sun 10/18/2009 4:41 PM<br>
To: Barron, Josh; Patrick Domack; <a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br>
Subject: RE: [Pdns-users] Please validate my PowerDNS Infrastucture proposal<br>
<br>
In a sense, you are are deploying a stealth master -- one that the outside world cannot directly query, and one that does not appear in the RRset of your domains (therefore making it "stealth").<br>
<br>
One option:<br>
<br>
Assuming that you are using a SQL based backend, you can make all changes on your stealth master. These changes are then replicated (using MySQL replication, etc) to the four public DNS servers. No need for AXFR zone transfers or anything.. everything is handled at the database layer.<br>
<br>
Josh<br>
<br>
________________________________<br>
<br>
From: <a href="mailto:pdns-users-bounces@mailman.powerdns.com">pdns-users-bounces@mailman.powerdns.com</a> on behalf of Barron, Josh<br>
Sent: Sun 10/18/2009 5:04 PM<br>
To: Patrick Domack; <a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br>
Subject: Re: [Pdns-users] Please validate my PowerDNS Infrastucture proposal<br>
<br>
<br>
<br>
Maybe I'm confused about the concepts.<br>
The idea is to make the publicly available name servers slaves to the master (which doesn't respond to public queries). If I use database replication, won't it just replicate the entire database, requiring all the servers to be masters?<br>
<br>
<br>
<br>
<br>
-----Original Message-----<br>
From: Patrick Domack [mailto:<a href="mailto:patrickdk@patrickdk.com">patrickdk@patrickdk.com</a>]<br>
Sent: Sun 10/18/2009 12:59 PM<br>
To: Barron, Josh<br>
Subject: Re: [Pdns-users] Please validate my PowerDNS Infrastucture proposal<br>
<br>
I would question the usage of using superslave, unless you have other<br>
master servers that don't run powerdns somewhere.<br>
<br>
I would personally just use the built in database replication to<br>
distribute updates, then depending on superslave, it will cause less<br>
updates to happen (just the record that changed, vs the whole domain)<br>
and is much easier to secure.<br>
<br>
<br>
Quoting "Barron, Josh" <<a href="mailto:jbarron@afsnetworks.com">jbarron@afsnetworks.com</a>>:<br>
<br>
><br>
> Hello all,<br>
><br>
> Please validate my proposed PDNS based infrastucture:<br>
><br>
> Customers (and internal support technicians) will login to "PowerDNS<br>
> on Rails" or "PowerAdmin" Frontend server. This server will host<br>
> PDNS (not PDNS-Recursor) but will not respond to DNS queries from<br>
> the Internet. Its only access from behind the firewall will be<br>
> web-based for domain administration.<br>
> 4 other servers, geographically distributed, will be used to run<br>
> PDNS and PDNS-Recursor. I would like them configured in possibly a<br>
> superslave configuration. Basically what I'm looking for is when<br>
> the "Master" server described above creates a new domain or updates<br>
> a domain, it sends notifies to the slaves to update or add the zone.<br>
> I want the name servers that respond to DNS queries to be slave<br>
> servers and precursors only to try to mitigate any possible poisoning.<br>
><br>
> What am I missing, if anything? Any feedback or suggestions, even<br>
> criticism, is welcome. We are trying to create a geographically<br>
> diverse, secure, and reliable DNS infrastructure for us and our<br>
> customers. We are migrating from a dual server setup (West running<br>
> Bind 9, East running Men&Mice).<br>
><br>
> Thanks!<br>
> -Josh<br>
> _______________________________________________<br>
> Pdns-users mailing list<br>
> <a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br>
> <a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
><br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
Pdns-users mailing list<br>
<a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br>
<a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
<br>
<br>
<br>
_______________________________________________<br>
Pdns-users mailing list<br>
<a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br>
<a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
</div></div></blockquote></div><br>