Re: securing bind in todays hostile environment

2020-01-20 Thread N. Max Pierson
Ah, allow me to apologize then. Since I did not see any mention as to why you possibly didn’t think ansible would serve us well for this job I had wrongly assumed you to had maybe demo’d or just got handed the task of automating in your organization and didn’t have time to research or test it be

Re: securing bind in todays hostile environment

2020-01-20 Thread N. Max Pierson
It makes me feel a little better about managing our own instances versus handing it off to some other cloud provider. Regards, m > On Jan 19, 2020, at 11:23 AM, Grant Taylor via bind-users > wrote: > > On 1/19/20 3:25 AM, N. Max Pierson wrote: >> Hi Grant, > > H

Re: securing bind in todays hostile environment

2020-01-19 Thread N. Max Pierson
you still want to live in ansible I would suggest > that you add another NIC to each server and assume the IPs of the old servers > so you dont bring cruft forward into your new world order.) > > > > John > > Sent from Nine <http://www.9folders.com/> > From:

Re: securing bind in todays hostile environment

2020-01-19 Thread N. Max Pierson
ement them should they apply to our deployment. Thanks for the lengthy and descriptive response. It gives me several things to think about and research. Regards, m > On Jan 18, 2020, at 11:59 AM, Grant Taylor via bind-users > wrote: > > On 1/18/20 7:06 AM, N. Max Pierson wrote:

securing bind in todays hostile environment

2020-01-18 Thread N. Max Pierson
Hi List, First off, I should note that I am a novice with administering Bind, so please bear with me. We are looking to be more pro-active and security minded in our network in general and while we are getting ready to completely replace/upgrade our current instances of Bind, I would like to

RNDC Stats

2019-01-24 Thread N. Max Pierson
Hi List, I am trying to pull some metrics from our bind servers and I don't quite understand what some for the stats in the file really mean. What I am looking for is total queries and then a breakdown of total queries for each zone. Under Incoming Requests it has QUERY's among some other stats. I

Re: EDNS Compliance

2019-01-18 Thread N. Max Pierson
ckpoint > were > thinking of changing the defaults. You just need to turn off the setting > on the > Juniper. It really shouldn’t be on by default as it doesn’t do anything > useful. > > > On 19 Jan 2019, at 7:52 am, N. Max Pierson > wrote: > > > > I was jus

Re: EDNS Compliance

2019-01-18 Thread N. Max Pierson
erver to return it. There is no need for a firewall to > drop queries with these properties. > > Please file a bug report with Juniper. > > Mark > > > On 19 Jan 2019, at 4:02 am, N. Max Pierson > wrote: > > > > Hi List, > > > > I am trying to ensu

Re: EDNS Compliance

2019-01-18 Thread N. Max Pierson
ld check the FW logs to find the log of the drop and work back from > there. > > On Fri, Jan 18, 2019, 12:29 PM N. Max Pierson wrote: > >> Thanks to the response Ben. After looking at the results, it seems we do >> have a different firewall between the 4 servers and they have

Re: EDNS Compliance

2019-01-18 Thread N. Max Pierson
wrote: > As long as all 4 DNS servers are running the same version, my first > suggestion would be to check firewalls for dropped packets. > > Some FW/IPS drop packets with edns versions other 0 because they see it as > an attack. > > On Fri, Jan 18, 2019, 12:02 PM N. Max Pi

EDNS Compliance

2019-01-18 Thread N. Max Pierson
Hi List, I am trying to ensure our Bind servers comply with EDNS for the upcoming Flag Day (https://dnsflagday.net/). I am somewhat ignorant to EDNS but from what I have read, the information is somewhat conflicting as some documentation states EDNS is not a record that you configure in your zone