Subject: Re:

From: "Art Shelest" <[email-masked]>
Date: Sat, 1 Jun 2002 18:05:43 -0700

Hi:

Secure name resolution question: is there an existing mechanism that
permits 
configuring DNS server to only resolve name X for authorized clients?

For example, I would like to have www.example.com only be resolvable by
members of a specific group, and make it "invisible" to others.

Thanks!

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Rob Austein <[email-masked]>
Date: Sun, 02 Jun 2002 13:39:43 +0200

At Sat, 1 Jun 2002 18:05:43 -0700, Art Shelest wrote:
> permits configuring DNS server to only resolve name X for authorized
> clients?
> 

This was an explict non-goal for DNSSEC (RFC 2535 et seq).  DNSSEC
explicitly does not attempt to provide confidentiality.

You could probably hack together something based on TSIG (RFC 2845).
It wouldn't scale, and I wouldn't advise it, but it's your life....

---

From: Kevin Darcy <[email-masked]>
Date: Mon, 03 Jun 2002 13:58:34 -0400

> members of a specific group, and make it "invisible" to others.

I assume by "invisible" you mean that the nameserver responds that the
name doesn't exist, as opposed to REFUSE'ing the query, which would let
the "forbidden" clients know that something is there (?)

You could define those "special" names as zones by themselves, and then
define separate "view"s for the "permitted" versus the
"forbidden" clients. This would require BIND 9, which supports "view".
Note, however, that this would be a lot of work to set up and maintain,
since *every* existing zone on the nameserver would need to be defined and
maintained in each "view" (but you may be able to play
multiple-references-to-the-same-file or $INCLUDE-file games to make your
life easier in this regard...).

- Kevin

---

From: Peter Koch <[email-masked]>
Date: Mon, 03 Jun 2002 20:21:09 +0200

Hi,

> > members of a specific group, and make it "invisible" to others.

[...]
> "forbidden" clients. This would require BIND 9, which supports "view".

while all these implementation specific solutions (hacks, YMMV) exist, they
are applicable in limited scenarios only. There is no interoperable way
to communicate scopes or views between primary and secondary nameservers,
since the amount of metadata exchanged in a zone transfer is limited to
what the SOA RR can carry.

-Peter

---

From: [email-masked]
Date: Mon, 03 Jun 2002 20:21:09 +0200

Hi,

[...]

-Peter