Chapter 11. Security
"I hope you've got your hair well fastened on?" he continued, as they set off. "Only in the usual way," Alice said, smiling. "That's hardly enough," he said, anxiously. "You see the wind is so very strong here. It's as strong as soup." "Have you invented a plan for keeping the hair from being blown off?" Alice enquired. "Not yet," said the Knight. "But I've got a plan for keeping it from falling off."
Why should you care about DNS security? Why go to the trouble of securing a service that mostly maps names to addresses? Let us tell you a story.
In July 1997, during two periods of several days, users around the
Internet who typed www.internic.net into their web browsers thinking they were going to the InterNIC's web site instead
ended up at a web site belonging to the AlterNIC. (The AlterNIC runs
an alternate set of root name servers that delegate to additional
top-level domains with names like med and porn.)
How'd it happen? Eugene Kashpureff, then affiliated with the
AlterNIC, had run a program to "poison" the caches of
major name servers around the world, making them believe that
www.internic.net's address
was actually the address of the AlterNIC web server.
Kashpureff hadn't made any attempt to disguise what he had
done; the web site that users reached was plainly the
AlterNIC's, not the InterNIC's. But imagine someone
poisoning your name server's cache to direct www.amazon.com or www.wellsfargo.com to his own web server,
conveniently well outside local law enforcement jurisdiction.
Further, imagine your users typing in their credit card numbers and
expiration dates. Now you get the idea.
Protecting your users against these kinds of attacks requires DNS
security. DNS security comes in several flavors. You can secure
transactions—the queries, responses, and other messages your
name server sends and receives. You can secure your name server,
refusing queries, zone transfer requests, and dynamic updates from
unauthorized addresses, for example. You can even secure zone data by
digitally signing it.
Since DNS security is one of the most complicated topics in DNS,
we'll start you off easy and build up to the hard stuff.
|
