BIND Security
BIND supports a number of different methods to protect the updating and transfer of zones, on both master and slave nameservers:
DNSSEC — Short for DNS SECurity, this feature allows for zones to be cryptographically signed with a zone key.
In this way, the information about a specific zone can be verified as coming from a nameserver that has signed it with a particular private key, as long as the recipient has that nameserver’s public key.
BINDversion 9 also supports the SIG(0) public/private key method of message authentication.
TSIG — Short for Transaction SIGnatures, a shared secret key exists on the master and slave server, verifying that a transfer from master to slave is authorized.
This feature strengthens the standard IP address-based method of transfer authorization. An attacker would not only need to have access to the IP address to transfer the zone, but they would also need to know the secret key.
BINDversion 9 also support TKEY, which is another shared secret key method of authorizing zone transfers.
Leave a Reply
You must be logged in to post a comment.
