Subject: Access controls on DNS queries (was RE: [no subject])

From: "Loomis, Rip" <[email-masked]>
Date: Mon, 3 Jun 2002 09:33:09 -0400

On Sunday, 02 June, 2002 06:40, Rob Austein wrote:
> At Sat, 1 Jun 2002 18:05:43 -0700, Art Shelest wrote:
> > 
> > Secure name resolution question: is there an existing mechanism that
> > permits configuring DNS server to only resolve name X for authorized
> > clients?
Short answer:  Yes--this is implemented in BIND 8/9 and in other
independent code bases--the primary implementation of which
I'm aware is in BIND.  Establish an ACL for specific authorized
clients (authorization either to "those in netblock XXX" or
"those who hold TSIG key XXX").  Then use either "views" (BIND 9 only)
or "allow-query{}" to allow/deny access to specific data.  If there is
a single zone that will contain both "public" and "private" data
records (similar to what Axent Raptor FW DNS provides) then use
views--if the limitation is on a zone-by-zone basis then one
could simply use allow-query{} (but views might be a better choice
if BIND 9 is to be used).

There's no capability to effectively do this sort of thing in any
current MS product...but if you're going to add it (in an
interoperable way) then I have a rather large customer who would
love to know more...since the lack of this functionality in MS
products causes much wailing and gnashing of teeth.

> > For example, I would like to have www.example.com only be 
> > resolvable by members of a specific group, and make it
> > "invisible" to others.
> This was an explict non-goal for DNSSEC (RFC 2535 et seq).  DNSSEC
> explicitly does not attempt to provide confidentiality.

True, but he didn't ask for confidentiality on the wire--or if that
was what he wanted then it wasn't clear.  I read it as asking about
access control on specific data--it's not an uncommon request/
problem.

> You could probably hack together something based on TSIG (RFC 2845).
> It wouldn't scale, and I wouldn't advise it, but it's your life....

Actually, if it's for MS and it starts out based on GSS-TSIG, then
it likely would scale...it just wouldn't be highly interoperable.
(Note that GSS-TSIG as currently implemented in Win2K/XP is supported
only for secure dynamic update--not for protection/authentication of
zone transfers or regular query/response traffic.  It would appear that
all Art needs is to extend the existing GSS-TSIG implementation to also
protect these other common DNS transactions, and then provide a
pointy-clicky GUI to configure the access controls.)

--
Rip Loomis                         Senior Systems Security Engineer
SAIC Secure Business Solutions Group         www.saic.com/securebiz
Center for Information Security Technology   www.cist-east.saic.com

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Yuji KAMITE" <[email-masked]>
Date: Tue, 4 Jun 2002 13:26:43 +0900

> There are a lot of GSS-TSIG documents out there currently and it looks like
> there is enough available to write an implementation. But it has proved too
> complex for us to determine this within a working day of trying to make
> sense of what is what, and if everything is there.
> 
> Does anybody know if it is theoretically possible to interoperate with
> GSS-TSIG from something that is not written on Windows or tightly integrated
> with it?

It is said that recent BIND9 has interoperability with GSS-TSIG,
(according to BIND configuration manual and source code)
but I don't know what actually it is like ( I haven't made use of it),, sorry.

-
GSS-TSIG DNS would be one of local approach for providing security,
but I have had a question for long time .. 
Is it possilbe or proper to apply GSS-TSIG in more general DNS world as 
practical/ideal soluction? (especially, in what sense GSS-TSIG can be more
scalabe or useful??...etc)

I think today GSS-TSIG cannot help being closed within the limited world of the 
Kerberos-(or something) compatible environment.(in fact, Win2k/XP today).
My impression is,  when it comes to the interoperablity with all other approaches
(i.e, protocols not using GSS-like highly abstract mechanism), we tend to 
be confronted with quite a few difficluties ...
so I need clear explanation/document about GSS-TSIG, too. 

---
Yuji Kamite   (mailto:[email-masked])
Innovateive IP Architecture Center,  NTT Communications
Tel:+81-3-6800-3112, Fax:+81-3-5365-2990

---

From: "James Gilroy" <[email-masked]>
Date: Tue, 4 Jun 2002 14:02:41 -0700

> Unless things have changed radically since I stopped 
> following BIND closely, no, it doesn't.  There were some 
> preliminary attempts, but we ran into the problem that what 
> Microsoft documented in the then-current draft and what they 
> actually did in Windows were different.  At that time, they 
> also had not published some of the security context goop that 
> made it possible to use GSS-TSIG in a useful fashion.  I'm 
> told they have remedied both of these (albeit, in .Net 
> server, not in Win2K).
> 
> I understand that the folks over at Lucent have gotten BIND 
> to interoperate with Windows GSS-TSIG, however I do not 
> believe they have released that code.

David pretty much summed up the situation:
=> Lucent has the interoperable implementation working on BIND
=> I did screw up a couple things in the win2K implementation -- and
feedback forced an additional change in the GSS-TSIG draft relative to
what shipped in win2K.
=> However, one clarification, the WindowsXP client is in compliance
with the spec.

Anyone who wants help interoperating I'll certainly be glad to provide
it -- including explanations of how Win2K clients deviates from the
GSS-TSIG RFC, if Win2K interop is desired.

Not being a security person, I'll skip comment on the merits of the GSS
approach relative others.

	jim