3
This is more of a Best Practices question than a technical one. I know I can fix this problem from my end. The question is whether I should...
I administer a private network/subdomain within the larger auspices of the corporate domain. So, I run dom.pvt
, sub1.dom.pvt
, sub2.dom.pvt
, and sub3.dom.pvt
. Outside of my little fiefdom, we have subd1.example.com
, subd2.example.com
, subd3.example.com
, and probably other sub-domains I don't know about. Those domains are used across the corporate globe. My named.conf
file includes a forwarders{}
clause to point to a DNS stack outside my domain for those hosts out there.
(Irrelevant "why am I asking this?" I have DNS sanity checking ("UseDNS yes
") set for all of my SSH daemons. If a host in the outside world tries to ssh to one of my hosts, the connection hangs or times out at the point that leads me to believe the sanity check isn't getting a return.)
If I do a simple hostname search ("host -v hostname
") for a host inside my private subdomain, I get a good return from my DNS server. If I do a simple search for any host outside my domain, the request times out. However, if I explicitly search for "host -v hostname.sub1.example.com
" I will get an immediate return.
So, if I wanted to expand my resolve.conf
search
parameter to include these "external" sub-domains, I could solve the problem. My question is whether or not doing so is my responsibility. Or, should I be telling the external administrators they need to change setting X to value Y, instead?
I already know of three sub-domains outside my little world. How many entries should I be expected to put my resolv.conf
search
value?
(Aside the second: I'm going to go do some Google searching on how to tell named to scan through all of its entries across all of its sub-domains before it forwards to the next host up the chain. If that's even possible.)
UseDNS doesn't confer much security advantage (there are far better ways to enhance authentication), so how about turning it off? – Paul – 2012-12-20T22:20:24.607
Unfortunately, our end customer uses it. One of the reasons we have our own little fiefdom is to run hosts that mimic this customer's configurations... shrug – dafydd – 2012-12-20T22:39:10.173