Re: [gentoo-user] Re: Secure DNS servers

[thegeezer]

On 06/16/2014 08:57 PM, James wrote:
> Michael Orlitzky <mjo <at> gentoo.org> writes:
>
>> On 06/16/2014 02:15 PM, James wrote:
>>> Hello,
>>>
>>> I'm reading up on how to secure DNS primary and secondary servers.
>>> I guess DNSSEC is pretty important. Any other areas I should read
>>> up on?  It's been a few years since I admin'd a dns server....
>> The benefits of DNSSEC are debatable. We're moving the centralized trust
>> from one group of scumbags (the CAs) to another group of scumbags (the
>> registrars). So the benefits to authentication are not entirely clear-cut.
except for the preventions of dns injection/ spoof floods
>> But, DNSSEC will eventually allow us to do away with the SSL racket, and
>> that can only improve security through the widespread adoption of
>> encryption. So it's a good thing either way.
> Sven's also into "selinux". I see no selinux policies or rules. Maybe
> I should drop him a line about selinux related to dns primary servers?
> Surely a selinux policy for a primary only selinux dns server would
> been keen? Not needed ? Overkill ?
how paranoid are you?
are you using SSL and fear the heartbleed will appear here too?
> I was going to read up a bit, before asking him questions I should
> have discovered from robust research on the subject......
>
>
>
>>> The iptables suggests seem trite and old.
>> Which suggestion? For a DNS server, you probably want something like,
>>
>>   iptables -P INPUT DROP
>>   iptables -A INPUT -p ALL -i lo -j ACCEPT
>>   iptables -A INPUT -p ALL -m conntrack --ctstate ESTABLISHED,RELATED \
>>     -j ACCEPT
>>   iptables -A INPUT -p ALL -m conntrack --ctstate INVALID -j DROP
>>   # Allow SSH, up to you
>>   iptables -A INPUT -p tcp --dport 22 -j ACCEPT
>>   # And allow DNS traffic
>>   iptables -A INPUT -p udp --dport 53 -j ACCEPT
>>   iptables -A INPUT -p tcp --dport 53 -j ACCEPT
how secure do you need this to be? how about
iptables -A OUTPUT -m state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --sport 53 -j ACCEPT
iptables -A OUTPUT DROP
in case your machine gets hacked ?
do you control all the clients connecting to the DNS ? then disable UDP
dns which is what the entire world uses, and then you can much more
easily control spoof flood amplification
>
> Ah, you've added to this iptables listing:
>
> http://wiki.gentoo.org/wiki/BIND/Tutorial
>
>
> So, I am looking for a minimal listing of flags  that is sufficient
> for a dns primary server, ssh and only necessary other services
> (make.conf).
it all depends on where the balance lays for you. do you have a text
only requirement for dns and no ssl ?
do you require ldap support or ip6 ? 
a minimal set for ISC BIND i think is nothing -- you can boot minimal
gentoo and websync and emerge net-dns/bind
a minimal gentoo running bind can easily fit with into a couple of GB
(or nothing with PXE boot) and 256MB RAM so you can have a hundred boxes
working in tandem.
assuming of course you have very small zones to load
>
> I'm thinking there should be tremendously reduced set of C libraries
> so as to remove potential  issues found on other services, or a
> secure, blessed C library commonly used for ultra tight servers.
you might also like to consider looking at embedded setups or
alternative to glibc such as uclibc but this is a little offtopic.
> I was also thinking of not mounting some partitions rw, but r only
> so  a manual reboot would be need to modify settings critical to
> security on the primary server. Good idea? Other similar ideas?
>
A wise idea, but then you are trading off manageability for security.  
ah security, the eternal balance, and only you can know where the
tipping point lies.