Re: What can djbdns, (or any DNS Server/cacher) do for me? - from Sh4d03

From: John Smith (jsmith_at_macroshaft.com)
Date: 12/02/04

  • Next message: Dave Uhring: "Re: What can djbdns, (or any DNS Server/cacher) do for me? - from Sh4d03"
    Date: Thu, 2 Dec 2004 13:43:06 -0500
    
    

    i agree with william on all of this as well...esp. when he states to
    implement something just for learning, despite what you can 'get out of it'
    at home. at home, most people need little more than a basic firewall. you
    sound like you are already pretty motivated anyway. also, i would say go
    ahead and buy a domain name and set up an authoritative DNS server and
    SENDMAIL config, again, just for learning purposes.. and well, it's kinda
    fun. (www.godaddy.com is very cheap for domains)
    i believe as soon as you 'activate'/run the stock version of BIND on Obsd
    that it will start caching look ups automatically..

    and one thing i haven't seen posted is that even M$'es dns config files are
    BIND compliant in format (this does not include AD integrated dns though).

    "William Ahern" <william@wilbur.25thandClement.com> wrote in message
    news:5pps72-79f.ln1@wilbur.25thandClement.com...
    > Sh4d03 <sh4d03@tpg.com.au> wrote:
    >> Thank you to both Mark and Peter,
    >
    >> However, there has been a little bit of a misunderstanding in what I
    >> initially asked. As a result of what you've both said I believe I'll
    >> switch
    >> to using BIND to start off with and then experiment with using DJBDNS.
    >
    >> What I was actually wanting was an understanding as to what 'type' of
    >> system
    >> I should/would be setting up? Am I correct in assuming I should be
    >> setting
    >> up a DNS cacher? Will that also handle all my DNS lookups if it doesn't
    >> know
    >> the answer itself? What's the correct terminology for this. I've looked
    >> at a
    >> few sites and docs etc but different people seem to be using different
    >> names
    >> for the different systems - very confusing.
    >
    > The different DNS functions provided by a DNS server include caching,
    > recursive resolution, and acting as an authority.
    >
    > Caching, of course, is just storing the results of a previous lookup. A
    > caching nameserver is usually also a recursive nameserver (that is,
    > recursively walking the authority chain to resolve some particular
    > address),
    > since you need something to cache. So, those two go hand-in-hand.
    >
    > Acting as an authority means that if you get a request for an address, you
    > give back a response directly. You already know the answer, because you're
    > the one that makes it up (or reads it from a config file--on disk or by
    > asking a cooperating primary server).
    >
    > The authority and recursive functions are sometimes split because you
    > might
    > want a DNS server to host a domain name, but you're not particularly eager
    > to do the leg work of recursive resolution of random domains for clients
    > (which can generate a lot of traffic).
    >
    > Also, sometimes you only want to do recursive resolution for particular
    > clients, for instance clients on your internal network. BIND 9 lets you
    > specify these types of ACL's directly, rather than handling it from the
    > network stack (e.g. by using PF).
    >
    >> Also, once setup - what benefits will this have for me? I realise that
    >> having a DNS cache will help a dial-up user, how much speed increase will
    >> I
    >> notice with a 128 DSL connection?
    >
    > Probably none. But it usually can't hurt, and would be a good learning
    > experience.
    >
    >> Further than this desire to "setup a DNS server" - I need someone to
    >> advise
    >> what 'type' of DNS "server/cacher" I will set up. Which would be in my
    >> best
    >> interest/benefit?
    >
    > Use the stock BIND 9 in OpenBSD until you have a reason not to. You may
    > never find such a reason. At the very least, keep a stock system until you
    > understand it well enough to know what you're changing. I liken it to
    > Legos.
    > When I was a kid I'd always put together a new lego set by following the
    > instructions first. I'd always tear it down afterwards, but I understood
    > that I could make something cooler by first understanding how the pieces
    > went together originally. If you just dumped the pieces on the floor and
    > went to town willy-nilly, 9 times out of 10 what you created was junk, and
    > you kept creating junk. You didn't really have a full idea of the
    > possibilities until you knew what somebody else did beforehand.
    >


  • Next message: Dave Uhring: "Re: What can djbdns, (or any DNS Server/cacher) do for me? - from Sh4d03"

    Relevant Pages

    • Re: What can djbdns, (or any DNS Server/cacher) do for me? - from Sh4d03
      ... Will that also handle all my DNS lookups if it doesn't know ... recursive resolution, and acting as an authority. ... clients, for instance clients on your internal network. ...
      (comp.unix.bsd.openbsd.misc)
    • [NEWS] BIND 9 DNS Cache Poisoning
      ... BIND 9 DNS Cache Poisoning ... source UDP port and DNS transaction ID can be effectively predicted. ... address of the target name server), and the destination UDP port (53 the ...
      (Securiteam)
    • [UNIX] Multiple Remote Vulnerabilities in BIND4 and BIND8
      ... ISS X-Force has discovered several serious vulnerabilities in the Berkeley ... Internet Name Domain Server (BIND). ... majority of DNS servers on the Internet. ... deployed recursive DNS servers on the Internet. ...
      (Securiteam)
    • Re: DNS Manipulation via IPTables or other means?
      ... You might use the BIND view functionality ... I thought I could alter DNS responses ... EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE ... The NSA has designated Norwich University a center of Academic ...
      (Security-Basics)
    • Re: DNS Manipulation via IPTables or other means?
      ... Not sure about iptables. ... I nwhat way is BIND not scalable -- ... I thought I could alter DNS responses ... EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE ...
      (Security-Basics)