From: shrchin@csug.cs.reading.ac.uk (Jonathan H. N. Chin)
Newsgroups: comp.sys.sun.admin
Subject: slave forwarding DNS
Date: 12 Sep 92 04:36:50 GMT
Organization: University of Reading

I am new to admin'ing, and am looking for some advice with an annoyance
I have run into. The last problem I posted about (restoring backups from
a tape that wouldn't read) resolved itself when the other set of backups
suddenly became readable after a weekend of attempting to read them.
Thanks to all the people who mailed me suggestions then.

We have a small network of 16 suns and numerous PCs and Archimedes.

One IPC (morpock) exports the important filesystems (like /home,
/var/spool/mail and various /usr directories) and is also the NIS server.
Nobody except root is allowed to log onto this machine and the machine
is prom-protected.

Another IPC (skund) has two ethernet cards and is the interface to the
outside world. ip_forwarding is switched off in the kernel, and users must
log onto this machine to connect to/from the outside world from/to
our system. This machine is the mail server. It is also prom-protected.

I have been attempting to find away to allow telnet, ftp, etc on skund
to use the DNS service provided by the computer services department of the
Uni. Creating an /etc/resolv.conf file with the appropriate address works
for nslookup, but fails for telnet, ftp, etc.

I have changed the Makefile in /var/yp on morpock to #define B=-b as it
says to do to no avail. Putting an /etc/resolv.conf on morpock to point to
the outside world would not work, and I assume that pointing to skund would
require skund to be running in.named.

The ideas I came up with either do not appear to work, or would be troublesome
to maintain, or would weaken the already fragile security that exists:

1) make skund into a slave forwarding DNS resolver.
   After creating an /etc/resolv.conf file on morpock pointing to skund,
   I created the config file on skund that the admin/networking manual said to:

/etc/named.boot:
forwarding 134.225.2.4 134.225.2.1 ; machines to get names from
slave ; tell named not to bother looking up anything locally

   and ran in.named but I still get "unknown host" when attempting telnet, ftp.

2) make skund a slave NIS server.
   Would solve the name lookup problem (I think) but would create other problems.
   We have lots of CS students next door, and every year a couple of them attempt
   to wreak havoc there. Their sysadmin tells me that the extent of their security
   (just about) is to protect their NIS server.
   ergo: this solution doesn't seem too sensible.

3) make skund into a DNS name-server. 
   Boy, that is hard work. Also seems like overkill since I dont need any
   of our machines to be visible to the outside world (except skund which 
   already is).

4) "switch off" NIS on skund.
   Difficult to maintain extra sets of passwords, hosts tables, etc and
   would conceivably be as vulnerable as running a NIS server on the machine
   in the first place. Also might not work since NIS is the bit that looks
   to DNS, and if NIS isn't running the libraries won't. (I think)

5) create a front end to all the system commands that take numbers or names.
   Would involve creating a front end to each command that replaces the name
   with the number. Something like:

     skund% FTP susssys1.rdg.ac.uk

   which would take the address, do the lookup and return the number, then call
   the real routine. Might even be better to write a script like:

     skund% TO susssys1.rdg.ac.uk ftp WHERE

   or:

     skund% TO susssys1.rdg.ac.uk telnet WHERE 6969

   that performs the nslookup, extracts the relevant information and calls
   the command with "WHERE" replaced by the number.
   This would be easy to do, but would require the user to master additional
   information. Also it is ugly.

I would prefer to get (1) to work as it would seem to be the nicest solution.
If anyone can explain to me how to get it working I would be eternally grateful
for five minutes. It would be nice to understand where I went wrong.

Otherwise, I will probably write the shell script for (5) and leave it at that.

PS. don't blame me for the machine names. I inherited them from the previous admin.

thanks in advance,
Jonathan
aka root@cyber.rdg.ac.uk
-- 
Jonathan H N Chin (9 kyu) \ Dept. of Cybernetics, \ "Respondeo, etsi mutabor"
shrchin@uk.ac.rdg.susssys1 \ University of Reading \
bq305@cleveland.freenet.edu \ Box 225, Whiteknights \ < Rosenstock-Huessy >
jockstrap,mandy@CyberSpaceII \ Reading, RG6 2AY, U K \
Newsgroups: comp.sys.sun.admin,comp.sys.sun.hardware