Security Question
Len Conrad
LConrad at Go2France.com
Wed Jul 21 20:55:40 UTC 2004
>I was reading some stuff by Microsoft on split dns. They insist that a
>dns server on a private network should never use a root hints file
WTF does MS know about DNS? never say never.
>What do you all think about this?
DNS servers with smart/interative resolvers on internal nets require access
to all internet that firewall policies will probably prefer to/insist on
discouraging.
A double-wall firewall with a DMZ on public IPs is a well-proven approach.
Put a resolving DNS, or two, in the DMZ, accepting recursive queries
forwarded from the internal NS. Minimizes traffic and rules at the
internal firewall separating the DMZ from the internal net, and hides the
internal NSs from Internet.
>Is it safe to use root hints from a
>private network behind a firewall
it's not automatically suicidal. host and network security can handle
iterative/resolving NSs on the internal net.
>or should you always forward?
it depends.
Len
_____________________________________________________________________
http://IMGate.MEIway.com : free anti-spam gateway, runs on 1000's of sites
More information about the bind-users
mailing list