From owner-freebsd-security  Thu Feb  1  7: 9:43 2001
Delivered-To: freebsd-security@freebsd.org
Received: from verdi.nethelp.no (verdi.nethelp.no [158.36.41.162])
	by hub.freebsd.org (Postfix) with SMTP id 3584C37B491
	for <freebsd-security@FreeBSD.ORG>; Thu,  1 Feb 2001 07:09:23 -0800 (PST)
Received: (qmail 38344 invoked by uid 1001); 1 Feb 2001 15:09:21 +0000 (GMT)
To: dillon@earth.backplane.com
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: FreeBSD Security Advisory: FreeBSD-SA-01:18.bind
From: sthaug@nethelp.no
In-Reply-To: Your message of "Wed, 31 Jan 2001 17:50:48 -0800 (PST)"
References: <200102010150.f111omZ23184@earth.backplane.com>
X-Mailer: Mew version 1.05+ on Emacs 19.34.2
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Date: Thu, 01 Feb 2001 16:09:21 +0100
Message-ID: <38342.981040161@verdi.nethelp.no>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

>     Umm... respectfully, you are not configuring your system correctly
>     if the down time affects you.  
> 
>     This is what we did at BEST:
...
>     * Three machines running named, non-recursive, ONLY used to serve
>       primary and secondary zones.  At least 20,000 zones, dup'd to each
>       box.
> 
>     We updated the primary DNS boxes four times a day.  We updated the boxes
>     one at a time, so at any given moment only one was 'down'.
> 
>     The DNS protocols handle the rest.  It's perfectly acceptable for a 
>     primary NS to be down as long as other primary NS's are up.

And that's where we like to keep the servers running - even if they are
running non-recursive, and (of course!) there are several servers for
each zone. Thus we prefer ndc reconfig/reload (and HUP before that was
available).

Steinar Haug, Nethelp consulting, sthaug@nethelp.no


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message