In a bit of bind...

Mon Jun 1 13:58:01 UTC 2009

Thanks very much for the various responses to my question; both on and off-list. 

I'm very much liking the idea of only letting the outside world see bind and then AXFR'ing the data from an easier-to-manage internal database backed solution.  Whether that be myDNS, Microsoft or whatever.   Bit of initial config work and then, in theory, an easy job to administer.

Actually feel a bit dumb for not considering that in the first place.  

Cheers again,

Ben

-----Original Message-----
From: Peter Hicks [mailto:peter.hicks at poggs.co.uk] 
Sent: 01 June 2009 12:42
To: Ben Matthew
Cc: nanog at nanog.org
Subject: Re: In a bit of bind...

Ben,

Ben Matthew wrote:
> I have six servers in total, two multi-homed servers for ordinary DNS and four servers running an Anycast network (2 x master and slave).
>   
For DNS, you may find it easier to outsource hosting to another provider 
who has geographically diverse DNS services.  This doesn't necessarily 
mean loss of control.  It also separates your nameserver hosting from 
your servers - suppose your network were to be under attack, or a 
configuration error dropped you offline.  If DNS were somewhere else, 
you could log in, change A records, point somewhere else.
> Anyway I've recently been investigating other options for DNS as, like many companies currently, we've laid off a bunch of staff and the overhead for maintaining BIND is quite high if done, like us, unassisted and you are editing zone files in a text editor.
>   
Revision control systems - CVS, Subversion - are your friend here.  What 
about wrapping up your DNS change procedure through perl or shell 
scripts which automatically roll back if bind doesn't reload, or some 
critical hosts suddenly disappear from the file.

Also, ask yourself what the cost of operating the service without 
changes is, and what the cost of each change is.  How often are you 
making changes?  How often do you need to make a change in an absolute 
emergency?  If changes are being done frequently, a technical or 
semi-technical member of staff will get to know the procedure.  If 
changes are being made rarely, can the changes wait for you to apply 
them if you don't feel comfortable with others doing it?
> Ultimately for our simple zones (non-Anycast, basic web forwarders) I want to create a web-app to do this for me, probably in PHP.  I could create something that...
Herein lies a problem - you want to create a web front-end to a DNS 
server.  You're going to have to do a lot of testing to make this play 
nicely, and you could introduce your own security holes or gotchas.  
What is the cost of creating something yourself?

How about one of the following?

  * Outsource DNS hosting, use another provider's interface to manage
  * BIND9 slaves, Windows-based master (hidden) which already has a GUI 
and it isn't difficult to change zones
  * Stick to what you have and document it, wrapping the 'apply' process 
in some simple shell or perl

Peter

________________________________________________
DISCLAIMER 
This e-mail message, including any attachments, is intended solely for the use of the addressee and may contain confidential information. If it is not intended for you, please inform the sender and delete the e-mail and any attachments immediately. Any review, retransmission, disclosure, copying or modification of it is strictly forbidden. Please be advised that the views and opinions expressed in this e-mail may not reflect the views and opinions of TIML Radio Limited or any of its parent and subsidiary companies.
Whilst we take reasonable precautions to ensure that our emails are free from viruses, we cannot be responsible for any viruses transmitted with this e-mail and recommend that you subject any incoming e-mail to your own virus checking procedures. Use of this or any other e-mail facility signifies consent to any interception we might lawfully carry out to prevent abuse of these facilities.
________________________________________________
TIML Radio Limited (trading as Absolute Radio)
Registered office: One Golden Square, London. W1F 9DJ
Registered in England No 02674136 VAT No 927 2572 11