EK 365
asked on
Concerns in using the same Infoblox grid master for both external and internal DNS
Hi, I got suggested external dns design which shows that sharing the same grid master for external and internal dns servers.
This grid master would be a hidden dns master for external dns but it would manage internal dns too. However, the grid master would not be an internal dns' dns master. Internal dns' SOA would be on diff box.
Do you guys think this design is security and operationally safe?
My initial reaction was what the heck why we share the same db for internal and external.
Grid master: GUI based IPAM and DB
DNS master: DNS master
This grid master would be a hidden dns master for external dns but it would manage internal dns too. However, the grid master would not be an internal dns' dns master. Internal dns' SOA would be on diff box.
Do you guys think this design is security and operationally safe?
My initial reaction was what the heck why we share the same db for internal and external.
Grid master: GUI based IPAM and DB
DNS master: DNS master
Last Comment
ASKER CERTIFIED SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
I am seeing the grid handling the pki aspect of dnssec. This extension ensures the integrity of data returned by domain name lookups by incorporating a chain of trust in the DNS hierarchy. The basis is pki. Normally, a chain of trust is built with public-private keys at each layer of the DNS architecture. Dnssec provides origin authenticity, data integrity and secure denial of existence. So, grid supposed to make sure that the dns servers can verify that data has originated from the correct authoritative source, and maintain data integrity to verify that responses are not modified in-flight.
Overall, the whole grid should provide resilient network services, failover, recovery, and seamless maintenance for such a deployment regardless of location e.g. inside a single building, across a networked campus, or between remote locations.
Overall, the whole grid should provide resilient network services, failover, recovery, and seamless maintenance for such a deployment regardless of location e.g. inside a single building, across a networked campus, or between remote locations.
ASKER
Thank You for your comment! Regarding dnssec, were you pointing about the fact that the grid master might be changed for failover so that dnssec source might be changed or dnssec should not be offered from hidden master? Please help me to understand.
First, dnssec does not provide DDoS protection, availability, data encryption, or confidentiality. However, the chain of trust to establish the dns response to client but be able to be resilient and secure. Hence since grid master is overseeing all dns server, it should not be revealed to the outside (ext). Treat is like a root CA which you also will not expose to ext or internet. The subordinate or delegated server will be exposed. Hence grid master should be obscured or "hidden" away .
Secondly, dnssec is using pki and there are multiple keys involved that should not be exposed like the private key. These key is for the dnssec use to ascertain that the zone and record is of good integrity. So if the key are stored in grid master server, it should not be exposed or hidden otherwise if there is any reason it cannot be hidden, the key should be stored in hsm (harden box). So default is that grid master is "hidden" away from direct access where possible. Once it is compromised, the pki running will not be trusted and dnssec will be tainted too.
Thirdly, back to why grid master is used is primarily also that pki management of individual dns server having their own key is operationally tedious and subjected to misconfirguration or overlook to renew key timely - that can cause unnecessarily denial of service or delay to dns response to client. Therefore grid master is used for the central management and oversight to relief this fatigue and (hopefully) avoiding inadvertent administrative action done. Grid master server becomes critical piece and need to be safeguarded and not exposed unnecessary for unauthorised access. So being hidden away is a mean to end to secure the dns infrastructure.
Overall, knowing the criticality of the master server, proxy to offload verifying of dnssec signature to response to the delegated dns server or client will keep master server away from being denial of service. I know F5 and Infoblox are partner to such setup. No matters what, if we treat grid master as critical, secure by default is not to even expose it to any possible attack attempt..
Hope it helps and pardon if it is not diving into the details as it rather should be the vendor saying and applying to your environment
Secondly, dnssec is using pki and there are multiple keys involved that should not be exposed like the private key. These key is for the dnssec use to ascertain that the zone and record is of good integrity. So if the key are stored in grid master server, it should not be exposed or hidden otherwise if there is any reason it cannot be hidden, the key should be stored in hsm (harden box). So default is that grid master is "hidden" away from direct access where possible. Once it is compromised, the pki running will not be trusted and dnssec will be tainted too.
Thirdly, back to why grid master is used is primarily also that pki management of individual dns server having their own key is operationally tedious and subjected to misconfirguration or overlook to renew key timely - that can cause unnecessarily denial of service or delay to dns response to client. Therefore grid master is used for the central management and oversight to relief this fatigue and (hopefully) avoiding inadvertent administrative action done. Grid master server becomes critical piece and need to be safeguarded and not exposed unnecessary for unauthorised access. So being hidden away is a mean to end to secure the dns infrastructure.
Overall, knowing the criticality of the master server, proxy to offload verifying of dnssec signature to response to the delegated dns server or client will keep master server away from being denial of service. I know F5 and Infoblox are partner to such setup. No matters what, if we treat grid master as critical, secure by default is not to even expose it to any possible attack attempt..
Hope it helps and pardon if it is not diving into the details as it rather should be the vendor saying and applying to your environment
DNS
The Domain Name System (DNS) is a hierarchical, globally distributed system responsible for associating the name of a computer, service or other resource into an IP address for connecting to the Internet or a private network. Most prominently, it translates domain names to the numerical IP addresses needed for the purpose of computer services and devices worldwide.
29K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
TRUSTED BY
ASKER