DNS – Practical Risks of Enabling Unsecure DNS Updates on Windows

active-directorydhcpdomain-name-systeminternal-dns

What are the practical risks of enabling the unsecure DNS updates on Windows?

As far as I found enabling the unsecure DNS updates is a requirement for enabling DHCP Linux clients from registering their names with a FQDN.

I do want to know that are the practical risks involved in this in order to evaluate if that's ok to have these enabled or not.

As far as I know a machine would not be able to takeover another reserved name which would be the only real concern that I now.

Obviously it would be the DDOS but considering that we are talking about intranet here, I doubt this could be a real risk.

Do you have it enable on your domain or not? Did you ever had to disable it due to having some problems with it?

Best Answer

You should basically never, ever allow non-secure updates. Personally I don't even like that the DNS server even allows you to turn off secure updates. This allows anyone on your network (like a hacker) to register DNS records with no Active Directory authentication required. This would allow the attacker to "spoof" a DNS name on your network and redirect people to another server than the one they thought they were going to.

Another example of when this setting can ruin your day accidentally rather than maliciously... someone turned secure updates off... all of the HP ILOs (out of band management) on all the machines on the network were suddenly able to start dynamically registering their own DNS records... but the ILOs were named the same as the servers, so they overwrote the host servers' DNS records!

Disabling secure updates is a terrible idea. Just don't.

For a possible solution for getting your Linux clients to leverage DHCP in order to register DNS records securely, this might help: Register A records for my Linux box on my Windows 2008 DNS/DHCP server

Related Solutions

Windows – What’s the command-line utility in Windows to do a reverse DNS look-up

ping -a w.x.y.z

Should resolve the name from the IP address if the reverse lookup zone has been set up properly. If the reverse lookup zone does not have an entry for the record, the -a will just ping without a name.

AD DNS Server – How to Resolve Requests for Internet DNS Record to Internal IP for Internal Clients

I can't create the zone superwebsite.mycorp.com inside the intranet: this would cause the AD DNS server to consider itself authoritative and ignore the real authoritative server outside of the intranet.

You can, and that's the only way you're going to get what you want. I've had similar setups in the past, and as dirty as doing this will make you feel, I've never had issues doing it.

The key is to create a zone whose name matches the FQDN, superwebsite.mycorp.com, not for mycorp.com as a whole. Then create a new A record in the zone with the relevant IP.

The only time this will present a problem is:

When the IP changes, you must remember to update it internally.
If you ever use 4th level names, i.e. something.superwebsite.mycorp.com, you also need to maintain these both in the Internet DNS and the internal DNS.

Best Answer

Related Solutions

Windows – What’s the command-line utility in Windows to do a reverse DNS look-up

AD DNS Server – How to Resolve Requests for Internet DNS Record to Internal IP for Internal Clients

Related Topic