[11419] in North American Network Operators' Group
Re: how to protect name servers against cache corruption
daemon@ATHENA.MIT.EDU (Paul A Vixie)
Tue Jul 29 22:18:57 1997
To: nanog@merit.edu
In-reply-to: Your message of "Tue, 29 Jul 1997 20:30:18 CDT."
<199707300130.UAA22939@enteract.com>
Date: Tue, 29 Jul 1997 18:59:32 -0700
From: Paul A Vixie <vixie@vix.com>
Let me put this another more interesting and more direct way.
Postulate a name server with the following properties:
1. Actually works on and is connected to the live Internet.
2. RFC compliant except as nec'y to comply with #1 above.
3. No DNSSEC, no TSIG, no SECUPD.
4. Completely bug free.
You go right ahead and build that name server, and I will drive a truck,
no, better still a bus or even a backhoe, right through its front window.
DNS is not secure and cannot be made so. BIND-8.1.1 is the best there is,
and it's what you should run, but as long as you run DNS without DNSSEC,
your confidence level should be set accordingly.
PS:
BIND is definitely #1, is almost #2, is definitely #3, and trying to be #4.
