[378] in Hesiod
Re: HESIOD type=maildrop class=IN, Sendmail
daemon@ATHENA.MIT.EDU (Michael Richardson)
Wed Mar 11 11:28:26 1998
Cc: "Theodore Y. Ts'o" <tytso@MIT.EDU>
To: hesiod@MIT.EDU
In-Reply-To: Your message of "Mon, 26 Jan 1998 23:04:39 EST."
<199801270404.XAA05181@dcl.MIT.EDU>
Date: Wed, 11 Mar 1998 11:25:31 -0500
From: Michael Richardson <mcr@sandelman.ottawa.on.ca>
>>>>> "Theodore" == Theodore Y Ts'o <tytso@MIT.EDU> writes:
Theodore> FWIW, the general design philosophy behind Hesiod, at
Theodore> least originally at Athena, is that if you need the
Theodore> ability to do overrides, then there should be some local
Theodore> file/database which the program consults first, and the
Theodore> fallback to Hesiod is used only if it isn't in the local
Theodore> file.
In general, it isn't local overrides that we are worried
about. Rather, the ability to control the root locally, thus excluding
hesiod data from outside one's domain of interest.
Theodore> Also, keep in mind that unless you're using DNS sec,
Theodore> Hesiod is not secure. It would be all too easy to
Theodore> poison your DNS cache so that mail to a particular user
Theodore> gets redirected to the wrong place. At MIT, we have al
Yes..
Theodore> of our client workstations route mail to a central
Theodore> mailhub (this also means that we don't have to worry
Theodore> about mail getting stuck on client workstation), and on
Theodore> the central mailhubs we use an aliases file, not Hesiod,
Theodore> in order to handle the destination routing.
Our goal is to distribute the load on the mail hub to different
machines, specifically, to distribute the network load of sending
email to particular domains. If we have to cross the network to reach
the machine with the alias file on it, and then cross the network
again to return to a user that was actually local, then that costs a
lot of bandwidth.
More importantly, it means that the machine with the alias file
becomes critical, and in the case of cooperative community networks,
makes one participant's continued involved critical.
] Network Security Consulting and Contract Programming | SSH IPsec [
] Michael Richardson, Sandelman Software Works, Ottawa, ON |international[
] mcr@sandelman.ottawa.on.ca http://www.sandelman.ottawa.on.ca/ |strong crypto[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy"); [
