Subject: RE: Access controls on DNS queries (was RE: [no subject])

From: Brian Wellington <[email-masked]>
Date: Tue, 4 Jun 2002 12:03:56 -0700 (PDT)

On Tue, 4 Jun 2002, Yuji KAMITE wrote:

> It is said that recent BIND9 has interoperability with GSS-TSIG,
> (according to BIND configuration manual and source code)
> but I don't know what actually it is like ( I haven't made use of it),, sorry.

Where do you see that?  There is basic (read: incomplete) support for the 
GSS-TSIG algorithm, but it does not work and is not built by default (and 
can't be built without changing the source code).  It is not mentioned 
anywhere in the documentation.

Brian

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: David Conrad <[email-masked]>
Date: Tue, 04 Jun 2002 12:34:28 -0700

Hi,

On 6/3/02 9:26 PM, "Yuji KAMITE" <[email-masked]> wrote:
> It is said that recent BIND9 has interoperability with GSS-TSIG, (according to
> BIND configuration manual and source code)

Unless things have changed radically since I stopped following BIND closely,
no, it doesn't.  There were some preliminary attempts, but we ran into the
problem that what Microsoft documented in the then-current draft and what
they actually did in Windows were different.  At that time, they also had
not published some of the security context goop that made it possible to use
GSS-TSIG in a useful fashion.  I'm told they have remedied both of these
(albeit, in .Net server, not in Win2K).

I understand that the folks over at Lucent have gotten BIND to interoperate
with Windows GSS-TSIG, however I do not believe they have released that
code.

> Is it possilbe or proper to apply GSS-TSIG in more general DNS world as
> practical/ideal soluction? (especially, in what sense GSS-TSIG can be more
> scalabe or useful??...etc)

I think you answer your own question:

> I think today GSS-TSIG cannot help being closed within the limited world of
> the Kerberos-(or something) compatible environment.(in fact, Win2k/XP today).

Rgds, 
-drc