Re: Extending UPDATE to add/remove zones

In message <[email protected]>, Derek Atkins writes:
> Alex Bligh <[email protected]> writes:
> 
> > On 16 Oct 2013, at 18:23, Derek Atkins wrote:
> >
> >> I admit I haven't read the whole draft, but my question is how do you
> >> authenticate and, more importantly, authorize the addition or (worse)
> >> deletion of zones?  Imagine an attack vector where someone could get
> >> your domain's DNS servers to stop serving your domain(s)!
> >> 
> >> I think the security of adding and (more importantly) removing zones
> >> should be carefully documented and discussed.
> >
> > I'm not sure why this would be different from someone doing an update
> > to remove the entire content of the zone served. Thus I don't really
> > see why it should need security any different from the existing
> > provisions for security.
> 
> Well, if somone can add zones to my server it could be a DoS against my
> network provider.  So how do you authorize the addition of new zones?

RFC 3007.

> This is something that's definitely a new feature and isn't effectively
> implementable using current UPDATE.
> 
> As for deleting zones vs deleting records, you're right that the
> authorization required to remove all the records in a zone are
> effectively the same as the authZ to remove the zone itself.  I believe,
> however, that authZ is usually on a record-by-record basis, generally
> providing for individuals to change the A record for their own devices.
> At least that's how I think it SHOULD be -- I've never deployed UPDATE.
> If that's the case then clearly one could have an AuthZ to remove the
> SOA (and thereby the whole zone).
> 
> I still think it should be spelled out instead of "left for the reader
> to figure out."
> 
> -derek
> -- 
>        Derek Atkins                 617-623-3745
>        [email protected]             www.ihtfp.com
>        Computer and Internet Security Consultant
> _______________________________________________
> dnsext mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/dnsext
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email protected]
_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext