25 Apr
2024
25 Apr
'24
3:46 p.m.
We do have a small number of /16 reverse zones that are delegated to other name servers,
what policies they decide to implement on their own servers is up to them, ARDC does not
dictate policy in this regard, except to expect they operate industry best practices,
don’t do anything that affects the security or reputation of ARDC and 44Net in general,
i.e. the usual caveats.
TBH I am not completely comfortable allowing zone transfers on our nameservers, I have
allowed it on one server because a few folks requested it, but I would like to work with
them to move to an alternative when convenient so I can turn it off again.
It is not best practice to allow zone transfers, even if (as I have done) it is restricted
to only 44Net source IPs. It leaves the name server open to DDOS attacks, it allows bad
actors to get a full view of all hosts thus increasing the attack vectors, i.e. they have
a better idea of which hosts to attack and what might be running on them.
There are better ways to get the information, i.e. via the Portal’s API that is
authenticated and therefore we can be sure who is asking for the data.
Hope that clarifies the current situation, but feel free to ask if I can help further.
73,
Chris - G1FEF
—
ARDC Administrator
Web: https://www.ardc.net
On 25 Apr 2024, at 08:38, Rob PE1CHL via 44net
<44net(a)mailman.ampr.org> wrote:
I think a point that has not been clear: ARDC *do* allow AXFR on ns.ardc.net. No issue
there.
What people were complaining about is that some zones that have been delegated to other
name servers
do not allow AXFR. E.g. Fredric Moses - W8FSM has been explaining here that he won't
allow AXFR
on his zones.
Now why one would not allow AXFR on a reverse zone to someone in net44 is completely
unclear to me.
It is easy to work around, after all. Probably they based their policy on
considerations
about a forward zone, and about allowing transfer to everybody.
Rob
On 2024-04-25 00:02, Jeff Parrish-Personal via 44net wrote:
Good evening, everyone,
I have been passively watching this heated discussion. I usually wouldn't jump in on
it, but I have some input.
1.
We are HAMS, and one of our goals is to better the hobby for everyone.
2.
I think finding a way to have multiple recursive DNS geographically disbursed is a
good idea.
3.
We must remember that any DNS we get from ARDC, whether ampr.org or ardc.net, is still
technically an ARDC ZONE, and they have the right to choose whether they will allow AXFR.
4.
While you need to have a DNS entry created in the ARCH Portal for IPIP to work, if you
have your own domain name, you can still use that. I own kb9gxk.net and will publish it
under my domain for anything I wish to allow others to access. I chose Cloudflare for
this as I can use their CloudflareD option to allow public access via my IP but keep the
actual HAM traffic going through my IPIP tunnel.
5.
There are no RFCs stating that a DNS server MUST allow for AXFR. That easily allows
for DNS poisoning. I'm hoping that ARDC's DNS servers are using DNSSEC to help
prevent this.
6.
Lynwood, if you have a server in a Data Center, why would you not work with them to
get a BGP connection instead of using IPIP? I'm not saying you have to; I'm just
curious.
7.
The new portal has given us much more access than the old one, and there are bound to
be bugs and delays as many more requests are being processed. I'm still having an
issue with my DNS stuff, but I am patiently waiting. In my case, my IPs were previously
assigned, and my "DNS Name" was created in the wrong domain, so when I had asked
for the previous assignments to be removed, I couldn't create the proper entries for
my IPs to work correctly. Again, I know they are backed up with tickets, and I will wait
patiently.
This whole discussion could have been handled differently. This could have started as a
proposal of ideas and asking for implementation.
As a side note, when I get passionate about something I believe and decide to write an
email, I use Grammarly to a) make sure my grammar is correct and b) check the tone of the
email. I have learned that my passion can be very off-putting, so I have found a way to
say what I need to, but it is not demeaning.
73,
Jeff Parrish - KB9GXK
_______________________________________________
44net mailing list -- 44net(a)mailman.ampr.org
To unsubscribe send an email to 44net-leave(a)mailman.ampr.org