Subject: RE: internal DNS issue

From: Malcolm Tester <[email-masked]>
Date: Tue, 12 Dec 2000 10:47:52 -0700

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Section 3.1 of the Docs (
http://www.fwtk.org/fwtk/docs/documentation.html#3.1 ):

...
Set up external DNS on the FWTK machine. 
This DNS server is the one that the InterNIC points to for your DNS. 
Create full DNS records for the host(s) you have directly connected to the
Internet. 
Do not give out information on your internal network here! SOA - source of
authority 
...
...
The EXTERNAL DNS (the one the Internet sees) is the primary DNS as far as
InterNIC is concerned. This server should have a cache file to leads to the
root level servers.  Note: This server only contains info I want the world
to know about. e.g. MX records and the addr of our external web and FTP
servers. 
...

/etc/hosts is queried by DNS, thus that is why.  At least on Solaris
machines.  perhaps it is different for other OS's, but the guy did say he's
using Solaris 2.6.

If the FWTK can't resolve an internal IP, it'll simply list it as "unknown".
Depending on what you need, this may or may not work.  You're right.  There
is a less risk to using /etc/hosts than using the full DNS server.  You have
more control over what "hostname" is valid and can be queried.  But if you
can avoid it, you should.

In my case, I actually have a more complex setup than most companies, I
would wager.  There are only two machines on my internal network than can
even see the firewall.  One is a unix "proxy" server, and the other is an NT
machine running Proxy Server 2.0.  (MS's replacement for that in 3.0 sucks
still).  Those two machines relay everything to and from the firewall to all
clients internally.  So the firewall only sees two other IP addresses on the
inside.  So having reverse lookups to those two ip addresses is not a big
deal for me.

Malcolm

-> -----Original Message-----
-> From: Michel Bardiaux [mailto:[email-masked]]
-> Sent: Tuesday, December 12, 2000 9:40 AM
-> To: [email-masked]'
-> Subject: Re: internal DNS issue
->
-> Why is it not recommended? The FWTK attempts to reverse-lookup *all*
-> connection attempts, whether they come from outside or from 
-> the internal
-> net. Seems to me that implies FWTK expects *some* resolver for the
-> internal hosts, and /etc/hosts seems to me safer (not to 
-> mention easier)
-> than trying to setup one's own DNS map. If /etc/hosts is a security
-> risk, then the FWTK should not attempt reverse-lookup on internal
-> addresses, is there a netperm-table command for that?
-> 
-> -- 
-> Michel Bardiaux
-> Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
-> Tel : +32 10 65.44.15  Fax : +32 10 65.44.10
->

---

From: Joseph S D Yao <[email-masked]>
Date: Tue, 12 Dec 2000 17:08:35 -0500

> machines.  perhaps it is different for other OS's, but the guy did say he's

Most name servers run the BIND software package.  This includes the
'named' name daemon, which NEVER looks at /etc/hosts.  It also includes
the resolver libraries.  The resolver libraries may be called by
gethostbyname(), etc.  These latter routines may look at /etc/hosts, or
do a NIS lookup, or do a Hesiod lookup, or just use pure DNS.  Most
systems nowadays [like Solaris] have some configurable way to determine
what lookups are done, and in which order.

So ... "DNS" never queries /etc/hosts.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Michel Bardiaux <[email-masked]>
Date: Wed, 13 Dec 2000 10:29:26 +0100

> So ... "DNS" never queries /etc/hosts.
I am confused by the sentence "It also includes the resolver libraries"
Does "it" refer to named or the BIND package? In other words, does named
use the resolver libraries? If no, then one can configure resolver to
use /etc/hosts *and*  DNS for the use of FWTK reverse-lookup, while only
the named configuration will be visible from the 'net, and Malcolm's
concerns disappear.

*But* if named uses the resolver, then if we give /etc/hosts to the
resolver we export internal network topology to the world; and if we
don't give it, then FWTK can not issue log messages with resolved IP
addresses. The first is bad, the 2nd is a pain.

There simply does not seem to be any good solution - apart maybe from
using patched resolver libraries with the FW apps,  patched to use a
different resolver configuration file from the rest of the system.

Greetings.
-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10

---

From: Joseph S D Yao <[email-masked]>
Date: Wed, 13 Dec 2000 11:31:35 -0500

> the named configuration will be visible from the 'net, and Malcolm's

Apologies.

The BIND package includes the resolver libraries.

The 'named' name daemon, also part of BIND, does NOT use the resolver
libraries.