I remember
The FreeBSD Diary |
|
(TM) | I remember |
|
Private DNS
8 July 1999
|
|
As a follow-up on the Secondary DNS article, I thought I
would write about how I created a private DNS. In this context, a private DNS is
restricted to certain sites or locations. If you are this interested in DNS, I suggest you purchase the DNS and Bind book. It's what I have and I referred to it many times when writing this article. Note: this method is simple and straight forward. But big sites do this differently. See the last paragraph for more information. |
|
Zone setup
|
| I wanted to make sure that people outside my LAN did not know what machines I had and
what the IP addresses were. So I started looking at how I could split my DNS into
two parts: public and private. Each of these two parts would be a separate zone.
The public zone will include things such as www, ftp, etc. In other words,
all the machines you want the public to know about. The private zone will include
the machines you don't want people to know about. This might include workstations,
secure servers, and generally anything which is not public. For this example, we will be using the domain yourdomain.org as an example. We will create a subdomain priv.yourdomain.org which we will hide from everyone but our trusted friends. |
|
The public zone
|
Here's the zone file for yourdomain.org as of 1999.07.08. Remember these points:
|
|
The private zone
|
Here's the zone file for yourdomain.org as of 1999.07.08. Remember these points:
If you can figure out the naming theme I used above, you get bonus points. Basically, you have to figure out what the above names nave in common. Answers/guesses should be added to the article comments. |
|
The reverse lookup file
|
This file allows you to find out the name of the box from the IP address.
|
|
named.conf
|
You will want to modify named.conf to use the above zone files.
Normally, this file is located in /etc/namedb, but you might find it in /etc/namedb.named.conf.
Here's what you need to add to use the above zone files:
|
|
What can be seen?
|
The object of this exercise is to restrict the access to the private section of your
domain. There are two types of things we want to prevent:
A query can be performed with nslookup and is for a single host. A zone transfer is used when someone wants to see everything in a particular zone. This can also be done via nslookup or with host. Here are some examples of what can be done with the above zone files if you don't make them secure.
As you can see, people can see that your subdomain priv.yourdomain.org exists. So it would be a simple process to do the following:
|
|
Restricting queries
|
We can restrict access to your private domain via queries with the following change to
named.conf. We do this by adding an allow-query clause to your zone
definition.
This modification will allow only the localhost and clients on the 192.168.0.* subnet to query the domain priv.yourdomain.org. Queries from all other addresses will be refused. With this command in place, direct queries result in this:
The above attempt from outside my domain resulted in this entry in my log file:
|
|
Restricting zone transfers
|
We can restrict access to your private domain via queries with the following change to
named.conf. We do this by adding an allow-transfer clause to your zone
definition.
As with the allow-query clause, this modification will allow only the localhost and clients on the 192.168.0.* subnet to perform a zone transfer on the domain priv.yourdomain.org. Transfer attempts from all other addresses will be refused. If we now try the same command from before, we get this: # host -l -v -a priv.yourdomain.org Using domain server: Name: some.other.domain Address: 127.0.0.1 Trying your.ns.ip.address Server failed: Query refused This results in the following type of entry in your log files:
|
| The above samples should work. If they don't, please let me know. Please note that this is a very simple solution. Big sites would hopefully not use this method. Instead, they would split the two zones onto two name servers. One name server would service requests coming from the outside (i.e. public requests). The other name server would service requests coming from the inside (i.e. private requests). But one day, I might try this approach. Right now I have enough machines, but I can't be bothered at the moment. |