Upgrade to 2000 DNS or stay with Unix Bind (Coexistence) ?

[Kevin Emore]

We are thinking of upgrading to Windows 2000 DNS and moving away from UNIX
bind has anyone done this and what are the security risks ?

What version of Bind does 2000 run ?

If the DNS server crashes in a domain would the users be able to resolve
using the top level DNS Server ?

Thank-you

 

[Keith W. McCammon]

We are thinking of upgrading to Windows 2000 DNS and moving away from UNIX

bind has anyone done this and what are the security risks ?

From a security standpoint, Windows-based name servers have actually had a
pretty clean bill of health, compared to BIND's regular pattern of
vulnerabilities.

What version of Bind does 2000 run ?

It doesn't.

If the DNS server crashes in a domain would the users be able to resolve
using the top level DNS Server ?

If you have a secondary DNS, then yes. If you're running a network with a
single name server, then no. But this is true of any name server
architecture. It has nothing to do with Windows 2000, BIND, etc.

 

[Kevin Emore]

Thanks Keith;
Just a few more questions. Do you know of any good articles to support the
switch from Bind to 2000 ?

Is there a name for the 2000 equivilant of Bind ? What is is Bind Release
Candidate 9.2.0 because that supports 2000.

My secondary DNS server would be for example microsoft..com and the server
that the users would authenticate to would be finance.microsoft.com if the
finance went away would the users be able to authenticate using
microsoft.com ?

Thanks

 

[Herb Martin]

Win2000 DNS should be preferred -- for internal systems
running Win2000+ support there is no contest.

For external DNS (the Internet) arguments can be made
either way.

Multimastered AD integrated DNS is just to big a win.

If you cannot replace the BIND for this case it is actually
worth delegating a child zone to do Win2000 there, e.g.,

bindDomain.Com --> w2kDomain.bindDomain.Com

Then use Win2000 on the child (w2kDomain) zone.

 

[Kevin Emore]

I need the documentation to prove that the correct move is from a Sun box to
w2k. Security and how it compares to the latest version of Bind. It sounds
like you can integrate BIND into Windows DNS is that correct?

External dns is currently not in-house.

 

[Ace Fekay [MVP]]

In

Thanks Keith;
Just a few more questions. Do you know of any good articles to
support the switch from Bind to 2000 ?

Configuring Berkeley Internet Name Domain (BIND) to Support Active
Directory:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechn
ol/iis/deploy/depovg/cfgbind.asp

Support WebCast Microsoft Windows 2000 DNS and UNIX BIND DNS
Interoperability:
http://support.microsoft.com/default.aspx?scid=/servicedesks/webcasts/
wc022602%2fwcblurb022602.asp

257462 - Dynamic Update Does Not Work Using BIND DNS Forwarder [shows Event
ID 5781]:
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q257462

Re DNS & Active Directory Questions - BIND Users ML Archive:
http://www.isc.org/ml-archives/bind-users/2001/01/msg00612.html

301191 - HOW TO Integrate DNS with Existing DNS Infrastructure If Active
Directory Is Enabled in Windows 2000:
http://support.microsoft.com/?id=301191

Q298448 - Windows 2000 DNS and Active Directory Information and Technical
Resources [Also Talks about how to use DCDIAG and NetDIAG Infrastructure
Implementation]:
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q298448

Is there a name for the 2000 equivilant of Bind ? What is is Bind
Release Candidate 9.2.0 because that supports 2000.

Not sure, but BIND 8.23 or better is recommended, preferrably the later
versions, but as Keith mentioned, BIND does have some vulnerabilities that
MS DNS doesn't. It'a actually your choice to incorporate BIND or W2k DNS.
This can come down to a political decision too. Either way, BIND will work,
however, you don't have the advantage of AD Integrated Zones. Besides,
Secure Updates in BIND do not work with W2k DHCP due to incompatible
methods.

Here's some info on AD Integrated Zones and AD and DNS in general:

Active Directory-Integrated Zones -Win 2003 (most applies to Win 2000 except
Application Partitions):
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/proddocs/depl
oyguide/dssbc_logi_lhld.asp

291382 - Frequently Asked Questions About Windows 2000 DNS and Windows
Server 2003 DNS:
http://support.microsoft.com/?id=291382

Choosing a Zone Type:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/proddocs/depl
oyguide/dnsbd_dns_nuql.asp

Windows 2000 DNS - Active Directory integration, multimaster replication,
dynamic and secure dynamic update, and aging and scavenging.:
http://www.microsoft.com/windows2000/techinfo/reskit/samplechapters/cncf/cnc
f_imp_orav.asp


In my opinion, W2k DNS is way easier to configure and support and I believe
is much more secure than BIND. Pretty much just install it and it works.

My secondary DNS server would be for example microsoft..com and the
server that the users would authenticate to would be
finance.microsoft.com if the finance went away would the users be
able to authenticate using microsoft.com ?

Thanks

With regard to AD, user accounts are domain specific and will only
authenticate by a DC in the domain that the account exists in. SO if the
account exists in example.microsoft.com, then a DC in that domain can only
authenticate that user account. Of course, the way it finds the domain
controller to authenticate it (as well as the GC for login and searches and
the Kerberos service for authentication) it queries DNS for the service
location and their resolve to the resource locations of those services.

Hope these links and info helps out.

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Herb Martin]

BIND can easily be a Secondary to a Win2000 DNS.
(and vice versa but you gain the most by having Win2000
Active Directory Integrated DNS server instead of THE
single Primary.)

For a large, distributed company, multi-mastered REGISTRATION
of dynamic updates is hard to beat. (AD-integrated DNS.)

Multi-mastered replication is another advantage, compressed
and secure between DCs using AD-integrated DNS.

With AD-integrated DNS.you have already done the work to
create your replication strategy when you arrange Win2000
replication so you get DNS replication for virtually free admin
time.

Finally, AD-integrated DNS.allows for SECURE dynamic
updates, preventing rogue (non-Domain/Forest) machines
from sending registrations.

 

[Kenneth Porter]

as Keith mentioned, BIND does have some vulnerabilities that
MS DNS doesn't.

Just to clarify, *old versions* of BIND have vulnerabilities. There are no
outstanding vulnerabilities in the current version, as ISC is very good at
fixing them.

Here's the fixed vulnerabilities in BIND:

http://www.isc.org/products/BIND/bind-security.html

Does MS maintain a similar list?

(And, Kevin, I agree with the others, for serving Win2k clients, use the
AD-integrated product from MS, and reserve BIND for your clients outside
your Win2k domain. And check the comp.protocols.dns.bind newsgroup ("the
other guys") for other perspectives.)