UNC Linux Users Group

[John Reuning <john AT metalab.unc.edu>]

On Fri, 2004-01-09 at 17:07, Jeff Bollinger wrote:

> > So....my question is, Oh Linux Gurus, should my system have noticed the
> > DNS change *without* an IP address change/lease expiration?  Why do the
> > Linksys-type boxes pick up those changes?

Glad you can break out into techieland, Joel. ;)

The dns servers are a dhcp config option, right?  When the linksys
router gets a lease from rr, it's given the dns servers by the rr dhcp
server.  From there, the router turns around and adds those to its own
dhcp server configuration.  Those are passed to the computers on your
home lan.   I think dhcp leases are renegotiated at half time to lease
expiration, so it probably picked up the change that way.

It's possible that the linksys router would have updated its dhcp
configuration and eventually passed along the dns server change to the
home machines during their own dhcp lease renegotiations.  I don't if
it's that smart, though.

> > An ancillary question...in the back of my mind, I remember that UNC now
> > does not allow DNS references from the outside world, right, due to
> > attacks last summer?  So I can't use the UNC DNS facilities...right?
> >
> 
> 
> Joel, good to see you on this list!  Have you checked out the
> 'allow-update' option under the 'zone' directive in named.conf?  I believe
> it will allow automatic
> DNS updates from a specified server.  Not the most secure method I'd
> imagine (given the possibility of DNS posioning), but it may do the trick
> that the Linksys boxes do.
> 
> I know that UNC blocks 152.2.21.1, but I'm not 100% sure we're blocking
> 152.2.253.100. If you're using the VPN though, you shouldn't have any
> problems.  I believe when connected through the VPN your DNS settings
> automatically get set to UNC's...

As I understand the unc dns server restrictions, recursive lookups are
blocked from non-unc ip addresses.  That means you can still get a reply
when you query a hostname in a zone for which unc is authoritative.  It
rejects all other queries, though.

-jrr

Attachment: signature.asc
Description: This is a digitally signed message part