Re: [dane] An AD bit discussion (correction)

Viktor Dukhovni <viktor1dane@dukhovni.org> Thu, 27 February 2014 23:09 UTC

Return-Path: <viktor1dane@dukhovni.org>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 674991A02C4 for <dane@ietfa.amsl.com>; Thu, 27 Feb 2014 15:09:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DwHkoYlrb7_a for <dane@ietfa.amsl.com>; Thu, 27 Feb 2014 15:09:25 -0800 (PST)
Received: from mournblade.imrryr.org (mournblade.imrryr.org [38.117.134.19]) by ietfa.amsl.com (Postfix) with ESMTP id 763C91A015E for <dane@ietf.org>; Thu, 27 Feb 2014 15:09:25 -0800 (PST)
Received: by mournblade.imrryr.org (Postfix, from userid 1034) id 25DBF2AAC73; Thu, 27 Feb 2014 23:09:22 +0000 (UTC)
Date: Thu, 27 Feb 2014 23:09:22 +0000
From: Viktor Dukhovni <viktor1dane@dukhovni.org>
To: dane@ietf.org
Message-ID: <20140227230922.GD21390@mournblade.imrryr.org>
References: <20140227041753.3509810773A8@rock.dv.isc.org> <20140227044213.GO21390@mournblade.imrryr.org> <alpine.LFD.2.10.1402270015320.6180@bofh.nohats.ca> <20140227054617.GP21390@mournblade.imrryr.org> <530F3A64.2000001@redhat.com> <20140227164014.GT21390@mournblade.imrryr.org> <20140227164201.GU21390@mournblade.imrryr.org> <530F9A3D.3070008@redhat.com> <20140227212614.GY21390@mournblade.imrryr.org> <alpine.LFD.2.10.1402271729140.1209@bofh.nohats.ca>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <alpine.LFD.2.10.1402271729140.1209@bofh.nohats.ca>
User-Agent: Mutt/1.5.21 (2010-09-15)
Archived-At: http://mailarchive.ietf.org/arch/msg/dane/3nQSWohZazvjN-xrPPf-VpX-NHw
Subject: Re: [dane] An AD bit discussion (correction)
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: dane@ietf.org
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane/>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 27 Feb 2014 23:09:27 -0000

On Thu, Feb 27, 2014 at 05:49:54PM -0500, Paul Wouters wrote:

> >I want the AD bit to be more than blind faith.
> 
> - Make unbound part of every install
>
> - Modify Anaconda/kickstart to take user's static DNS input and store
>   it somewhere (e.g. /etc/sysconfig/unbound or something)
>   and put 127.0.0.1 in resolv.conf
>
> - Modify unbound systemd service to run unbound-control forward_add
>   . <DNS info from sysconfig> in ExecStartPost=
>
> - Modify NM to run unbound-control forward_add . <DNS info from dhcp>
>   instead of modifying resolv.conf
> 
> no crypto library and no glibc modifications needed.

I agree, but one of the more vocal Postfix users does not.  Perhaps
we can ignore him as an unrepresentative zealot.  Objectively, I
see no reason to say no to a local validating cache.

If RedHat can standardize on a local validating cache on every
machine, that *is* better than hacking the AD bit, provided you
can ignore the zealots who insist that with a few LAN-local caches,
adding local caches on each machine is somehow bad.

My point that with virtual machines context switching to a different
VM is likely much more expensive than context switching to a local
process did not make much of an impression.

So *if* there is a local resolver and it is the only one used,
great!  No need to disable the AD bit.  If there is not, perhaps
"failing safe" is sensible.

It may be enough to design systems that default to local resolvers,
and users who change that are free to shoot themselves in both feet.

-- 
	Viktor.