• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

DNS Dynamic Updates + DnsUpdateProxy = insecure DNS records?

Jeff7181

Jeff7181

Lifer
I'm trying to wrap my brain around this... I kinda sorta maybe think I might understand it. 🙂 Here's my thinking, hopefully someone can verify that I'm correct to explain why I'm wrong.

Scenario: A DHCP server, which is a member of the DnsUpdateProxy group, registers a record in Active Directory for a Windows 98 machine.

The A resource (for example) is not secure because records created by the DnsUpdateProxy group have no owner until the record is modified by another DNS client or DHCP server and can be modified by any user (authorized or not) until that happens.

The book also says that if the DHCP server happens to be running on a machine that's also a domain controller, the SRV and CNAME also become insecure. This is where it gets blurry for me. I can't understand WHY this happens.

Assuming it does, would this be a practical use for Virtual Machines? Allowing one physical machine to run the DNS Server, DHCP server, AND act as a domain controller without this security issue?
 
Because when you add a server (any kind of server) to the DnsUpdateProxy group, any records that particular server registers in DNS will be insecure. On a DHCP server that is not a DC, that would just be the server's A record. But on a DHCP server that is also a DC, that would be ALL the records in the netlogon.dns file, which are the SRV and CNAME records.

In a virtual environment, this is probably not a big deal. You wouldn't want to put DHCP on a DC in production though.
 
So theoretically that issue could be avoided by running the DHCP and DNS servers in one VM, and the domain controller in another VM. Aside from the performance loss of running within a VM, is there any reason you wouldn't want to do that?
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top