Resolving DNS on FreeBSD Past, present, future Erwin Lansing, DK - - PowerPoint PPT Presentation

▶
resolving dns on freebsd past present future
SMART_READER_LITE
LIVE PREVIEW

Resolving DNS on FreeBSD Past, present, future Erwin Lansing, DK - - PowerPoint PPT Presentation

Oct 03, 2022 98 likes •210 views

Resolving DNS on FreeBSD Past, present, future Erwin Lansing, DK Hostmaster A/S Past History named at least since FreeBSD 2.0 with NAMED 4.9.3-beta libc res_* at least since 4.3BSD Complete BIND in base nslookup,

slide-1
SLIDE 1

Resolving DNS on FreeBSD
 Past, present, future

  • Erwin Lansing, DK Hostmaster A/S
slide-2
SLIDE 2

Past

  • History
  • named at least since FreeBSD 2.0 with NAMED 4.9.3-beta
  • libc res_* at least since 4.3BSD
  • Complete BIND in base
  • nslookup, host, dig, nsupdate
  • named
  • recursor
  • authoritative
  • dnssec-keygen, dnsec-signzone, etc.

2

slide-3
SLIDE 3

Why not BIND?

Technical, not political!

  • ISC is a major sponsor of FreeBSD Project infrastructure

3

slide-4
SLIDE 4

Why not BIND?

  • Smaller codebase
  • recursor only
  • Security Advisories
  • see smaller codebase
  • highly scrutinised
  • not necessarily related to code quality
  • Support lifecycle
  • upgrading or backporting
  • not better in other projects
  • BIND10
  • external dependencies
  • python
  • botan
  • BIND9 EOL?
  • Historic implementation on FreeBSD
  • Too many options to support

4

slide-5
SLIDE 5

Abbreviated wish list

  • DNSSEC-aware resolver library
  • Caching recursor daemon
  • CLI tools
  • Liberal license (BSD or similar)

5

slide-6
SLIDE 6

Ecosystem

  • BIND
  • knot
  • Powerdns
  • djbdns
  • dnsmasq
  • ldns / unbound
  • …

6

slide-7
SLIDE 7

If not BIND, then…

  • BIND
  • knot (GPL, utilities only)
  • Powerdns (GPL)
  • djbdns
  • dnsmasq (GPL)
  • ldns / unbound
  • …

7

slide-8
SLIDE 8

Present

  • unbound
  • ldns
  • host-wrapper, drill
  • Local caching recursor daemon only
  • Any resolver supported as 3rd party package
  • Simple setup
  • For complicated setup, install package
  • DNSSEC validating
  • SSHFP
  • Easy to replace
  • FreeBSD 11

8

slide-9
SLIDE 9

Future

  • DNSSEC-aware resolver library
  • Caching resolver daemon
  • CLI tools (host, dig, (nsupdate))
  • Liberal license (BSD or similar)
  • low footprint
  • fast
  • thread safe
  • compartmentalised (Capsicum, Casper)
  • standardised API
  • DANE, SSHFP, …
  • [get-api (Hoffmann)]
  • draft-hayatnagarkar-dnsext-validator-api
  • In production in 1,5 years

9

slide-10
SLIDE 10

Questions?

  • erwin@dk-hostmaster.dk
  • Wiki:

https://wiki.freebsd.org/DNSBase

  • Slides:

http://people.freebsd.org/~erwin/presentations/20131118-ICANN-FreeBSD-DNS.pdf

10