<div dir="ltr"><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Nov 16, 2016 at 8:21 AM, Bob Harold <span dir="ltr"><<a href="mailto:rharolde@umich.edu" target="_blank">rharolde@umich.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div><div class="gmail-m_-1597930360539932671gmail_signature"><br></div></div><div class="gmail_quote"><span class="gmail-">On Wed, Nov 16, 2016 at 8:00 AM, Florian Weimer <span dir="ltr"><<a href="mailto:fweimer@redhat.com" target="_blank">fweimer@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span>On 10/29/2016 11:06 AM, Phil Regnauld wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Mark Andrews (marka) writes:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Thanks. Firewall are the biggest problems at the moment.<br>
</blockquote>
<br>
Firewalls in front of DNS servers still puzzle me.<br>
</blockquote>
<br></span>
If you want to run BIND, a packet filter in front of it currently is the only way to switch off processing of DNS UPDATE messages in BIND, so I can see why people do this.<span class="gmail-m_-1597930360539932671HOEnZb"><font color="#888888"><br>
<br>
Florian</font></span><div class="gmail-m_-1597930360539932671HOEnZb"><div class="gmail-m_-1597930360539932671h5"><br></div></div></blockquote><div><br></div></span><div>Why not just:</div><div><div class="gmail_default" style="font-size:small;display:inline"></div> allow-update { none; };</div><div>in BIND?</div><div>I would expect that to be not much work processing than what the firewall has to do, and less because of the overhead of the firewall. And definitely less likely to break things - the filter in the firewall in likely to mis-categorize some packets it has not thought of.</div></div></div></div></blockquote><div><br></div><div><div class="gmail_default" style="font-size:small">In a high security environment, the configuration is usually determined by the need to audit rather than efficiency.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">The role of a firewall is simply to gather together as many features that require audit into one place. This has been considered best security practice since Lampson was writing on this in the 70s.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">If you want security, you are best off concentrating all the settings for a particular security role into one place. Separation of duties is good, but the separation has to be explicit and documented. So in a secure site, there would be a firewall of the main servers under control of one admin and a separate admin would have control of the servers themselves.</div><br></div><div><div class="gmail_default" style="font-size:small">The problem that arises in separation of duties is that unless you treat policy failures as a breach, you can quickly end up with worse security. That happened in a case that I was involved in that went to trial earlier this year.</div><br></div><div><div class="gmail_default" style="font-size:small">So I would not accept the above setting unless it could be instrumented with an alarm:</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><div class="gmail_default" style="display:inline"></div> allow-update { set-off-security-alarm ("Firewall policy failure")};<br></div><br></div><div><div class="gmail_default" style="font-size:small">Sure, this is not something that you would do on core DNS supporting a major TLD. But those systems don't run BIND or anything close. The front end of those systems is in essence performing the same policy enforcement role as a firewall does.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">But it is very definitely something that you are going to find the auditors insist on in many environments.</div><br></div></div></div></div>