[Pdns-users] Please validate my PowerDNS Infrastucture proposal

[Barron, Josh]

I think I have it understood.  I just setup the public DNS servers to replicate the stealth master DNS server; everything else is resolved at the database layer.  The only vulnerability is that if my primary database is corrupted or compromised, the 4 public servers are instantly invalid.

Last question for now, do I do anything special with PDNS on the "public" name servers, or do I just set them up normally...

-Josh


-----Original Message-----
From: Baird, Josh [mailto:jbaird at follett.com]
Sent: Sun 10/18/2009 4:41 PM
To: Barron, Josh; Patrick Domack; Pdns-users at mailman.powerdns.com
Subject: RE: [Pdns-users] Please validate my PowerDNS Infrastucture proposal
 
In a sense, you are are deploying a stealth master -- one that the outside world cannot directly query, and one that does not appear in the RRset of your domains (therefore making it "stealth"). 
 
One option:

Assuming that you are using a SQL based backend, you can make all changes on your stealth master.  These changes are then replicated (using MySQL replication, etc) to the four public DNS servers.  No need for AXFR zone transfers or anything.. everything is handled at the database layer.
 
Josh
 
________________________________

From: pdns-users-bounces at mailman.powerdns.com on behalf of Barron, Josh
Sent: Sun 10/18/2009 5:04 PM
To: Patrick Domack; Pdns-users at mailman.powerdns.com
Subject: Re: [Pdns-users] Please validate my PowerDNS Infrastucture proposal



Maybe I'm confused about the concepts.
The idea is to make the publicly available name servers slaves to the master (which doesn't respond to public queries).  If I use database replication, won't it just replicate the entire database, requiring all the servers to be masters?




-----Original Message-----
From: Patrick Domack [mailto:patrickdk at patrickdk.com]
Sent: Sun 10/18/2009 12:59 PM
To: Barron, Josh
Subject: Re: [Pdns-users] Please validate my PowerDNS Infrastucture proposal

I would question the usage of using superslave, unless you have other 
master servers that don't run powerdns somewhere.

I would personally just use the built in database replication to 
distribute updates, then depending on superslave, it will cause less 
updates to happen (just the record that changed, vs the whole domain) 
and is much easier to secure.


Quoting "Barron, Josh" <jbarron at afsnetworks.com>:

>
> Hello all,
>
> Please validate my proposed PDNS based infrastucture:
>
> Customers (and internal support technicians) will login to "PowerDNS 
> on Rails" or "PowerAdmin" Frontend server.  This server will host 
> PDNS (not PDNS-Recursor) but will not respond to DNS queries from 
> the Internet.  Its only access from behind the firewall will be 
> web-based for domain administration.
> 4 other servers, geographically distributed, will be used to run 
> PDNS and PDNS-Recursor.  I would like them configured in possibly a 
> superslave configuration.  Basically what I'm looking for is when 
> the "Master" server described above creates a new domain or updates 
> a domain, it sends notifies to the slaves to update or add the zone. 
>  I want the name servers that respond to DNS queries to be slave 
> servers and precursors only to try to mitigate any possible poisoning.
>
> What am I missing, if anything?  Any feedback or suggestions, even 
> criticism, is welcome.  We are trying to create a geographically 
> diverse, secure, and reliable DNS infrastructure for us and our 
> customers.  We are migrating from a dual server setup (West running 
> Bind 9, East running Men&Mice).
>
> Thanks!
> -Josh
> _______________________________________________
> Pdns-users mailing list
> Pdns-users at mailman.powerdns.com
> http://mailman.powerdns.com/mailman/listinfo/pdns-users
>




_______________________________________________
Pdns-users mailing list
Pdns-users at mailman.powerdns.com
http://mailman.powerdns.com/mailman/listinfo/pdns-users