IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
S 4.108 Simplified and secure network management
with DNS services under Novell NetWare 4.11
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrator
A unique address must be assigned to every IT system in a TCP/IP network.
The Internet Protocol (IP) specifies this address as four decimal numbers
separated by a dot, each with a value range of between 0 and 255. As many
numeric addresses are difficult to remember, meaningful host names can be
assigned to the IT systems as well, e.g. www.bsi.bund.de. Resolution of host
names into IP addresses can be performed using two different mechanisms.
Under the first, an ASCII text file called HOSTS, which is stored in the
SYS:ETC directory, can be manually created. From a security and
administrative viewpoint this method should only be used in small networks
as the HOSTS file has to be stored individually on each server and each
workstation to enable local resolution. Special routines (e.g. login scripts) can
be used to automate distribution of the HOSTS file.
The second mechanism entails using a DNS server. Some of the aspects of
setting up and configuring a DNS server under Novell NetWare 4.11 which
require especial consideration in relation to system security are considered
below.
Function of the DNS components
The two main components of DNS are the name server and the resolver,
which is loaded on the client and queries the name server.
- Primary name server
The primary name server obtains the DNS entries for the zones for which it
is authorised from a file on its hard disk. "Authorised" here means that the
primary name server does not need to cross-check the DNS information
with any other name server for a given zone. At the same time the primary
name server is also the single point of administration for the domain. Only
one primary name server exists for each zone.
- Secondary name server
The secondary name server possesses a write-protected copy of the DNS
database of the primary name server. This copy is updated within a set
period of time which is specified in the record type SOA (Start of
Authority). Record types define the resource records which form the
entries in the DNS database. The copy operation is known as "zone
transfer" and forms the basis for updating the distributed DNS database of
a domain. Secondary name servers take on load distribution tasks, enable
the DNS database to be made available close to the resolver and create
redundancy of the DNS domain information. To ensure that the system is
fail-safe, at least one secondary name server should be configured for each
zone.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Link between IP
addresses and host
names
One primary name
server per zone
Load distribution,
reduction of network
traffic and redundancy