Subject: RE: Access controls on DNS queries (was RE: [no subject])

From: "James Gilroy" <[email-masked]>
Date: Tue, 4 Jun 2002 14:02:41 -0700

> Unless things have changed radically since I stopped 
> following BIND closely, no, it doesn't.  There were some 
> preliminary attempts, but we ran into the problem that what 
> Microsoft documented in the then-current draft and what they 
> actually did in Windows were different.  At that time, they 
> also had not published some of the security context goop that 
> made it possible to use GSS-TSIG in a useful fashion.  I'm 
> told they have remedied both of these (albeit, in .Net 
> server, not in Win2K).
> 
> I understand that the folks over at Lucent have gotten BIND 
> to interoperate with Windows GSS-TSIG, however I do not 
> believe they have released that code.

David pretty much summed up the situation:
=> Lucent has the interoperable implementation working on BIND
=> I did screw up a couple things in the win2K implementation -- and
feedback forced an additional change in the GSS-TSIG draft relative to
what shipped in win2K.
=> However, one clarification, the WindowsXP client is in compliance
with the spec.

Anyone who wants help interoperating I'll certainly be glad to provide
it -- including explanations of how Win2K clients deviates from the
GSS-TSIG RFC, if Win2K interop is desired.

Not being a security person, I'll skip comment on the merits of the GSS
approach relative others.

	jim

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>