Local DNSSEC resolver and Fedora cloud

[P J P]

Hello all,


As we know, Fedora-23 Alpha release has just been announced. Which means, most of the proposed features which are approved for F23 are in reasonably good shape for us to try out.

One of the proposed system wide change is to install and enable local DNSSEC validating resolver across Fedora variants.


-> https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Resolver

This features proposes to install unbound[1] DNSSEC resolver along with the dnssec-trigger[2] tool, which is used to dynamically configure the 'unbound' resolver. Upon successful setup, user would have the unbound[1] DNSSEC resolver listening on the 127.0.0.1:53 address. And the '/etc/resolv.conf' would point to this server as the designated 'nameserver' for the system.


Both unbound[1] & dnssec-trigger[2] packages are available in Fedora since long. And the proposed feature solution is known to work well for majority of the users. Currently work is in progress to ensure that the proposed feature works seamlessly well across all variants and addresses all use-cases for the Fedora users.


The feature has been approved for the upcoming F23 release; But we need affirmation from the individual working groups to install and enable this feature in the respective variants.


-> https://bugzilla.redhat.com/show_bug.cgi?id=1203950


The affirmation would enable us to include the 'dnssec-trigger' & 'unbound' packages in the respective Fedora kickstart files.

Could we please have your(cloud-WG) consent to enable this feature on the Fedora cloud variant?


If you have any concerns/comments/suggestions please let us know here.

--

[1] https://unbound.net/
[2] http://www.nlnetlabs.nl/projects/dnssec-trigger/

[3] https://lists.fedoraproject.org/pipermail/cloud/2015-July/005590.html


Thank you.

---Regards
-P J P
http://feedmug.com

[P J P]

Post by P J P
-> https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Resolver
-> https://bugzilla.redhat.com/show_bug.cgi?id=1203950
-> https://lists.fedoraproject.org/pipermail/cloud/2015-July/005590.html
Could we please have your(cloud-WG) consent to enable this feature on the Fedora
cloud variant?

Hello...!?!

---Regards
-P J P
http://feedmug.com

[Matthew Miller]

Post by P J P

Post by P J P
-> https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Resolver
-> https://bugzilla.redhat.com/show_bug.cgi?id=1203950
-> https://lists.fedoraproject.org/pipermail/cloud/2015-July/005590.html
Could we please have your(cloud-WG) consent to enable this feature on the Fedora
cloud variant?

Hello...!?!

Many people are at Flock this week. Please have patience.

[Haïkel]

Most of the Cloud WG is in Rochester so I can only second Matthew statement.

Regards,
H.

[P J P]

Post by Matthew Miller
Many people are at Flock this week. Please have patience.
Most of the Cloud WG is in Rochester so I can only second Matthew statement.

Oh right, okay. Thank you.
---
Regards
-P J P
http://feedmug.com

[Ryan Brown]

Post by P J P
Hello all,
As we know, Fedora-23 Alpha release has just been announced. Which
means, most of the proposed features which are approved for F23 are
in reasonably good shape for us to try out.
One of the proposed system wide change is to install and enable local
DNSSEC validating resolver across Fedora variants.
-> https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Resolver
This features proposes to install unbound[1] DNSSEC resolver along
with the dnssec-trigger[2] tool, which is used to dynamically
configure the 'unbound' resolver. Upon successful setup, user would
have the unbound[1] DNSSEC resolver listening on the 127.0.0.1:53
address. And the '/etc/resolv.conf' would point to this server as the
designated 'nameserver' for the system.

Conveniently, this came up at the DNSSEC session yesterday afternoon. I
won't speak for the whole group, but I'd be concerned about what cases
the resolver would be enabled for.

As a user for the cloud image (local virt, AWS) I don't think adding
unbound would be much of an improvement. For cloud image deployment
scenarios, if DNS security is of importance to my deployment, I can
enforce that external to the instance by running one (or several) DNSSEC
resolvers that can be shared between my whole fleet. In AWS, you can set
up your VPC to configure a custom resolver over DHCP, and there are
similar options in Azure/Rackspace/etc.

A 1:1 ratio of servers to DNS resolvers seems pretty wasteful to me,
especially in an environment where marginal performance increases cost
money. So I'd be against enabling a local DNSSEC resolver in the cloud
image.

For Atomic Host, I think it makes more sense to have a shared resolver.
In that case, the host's resolver can be shared by all the tenant
containers. Not only do you get to amortize the cost of running Unbound
across N containers on the host, but you get shared DNS caching as well.


tl;dr: please don't put it in the cloud image, but I think it makes
sense for Atomic Host.

Post by P J P
Both unbound[1] & dnssec-trigger[2] packages are available in Fedora
since long. And the proposed feature solution is known to work well
for majority of the users. Currently work is in progress to ensure
that the proposed feature works seamlessly well across all variants
and addresses all use-cases for the Fedora users.
The feature has been approved for the upcoming F23 release; But we
need affirmation from the individual working groups to install and
enable this feature in the respective variants.
-> https://bugzilla.redhat.com/show_bug.cgi?id=1203950
The affirmation would enable us to include the 'dnssec-trigger' &
'unbound' packages in the respective Fedora kickstart files.
Could we please have your(cloud-WG) consent to enable this feature on
the Fedora cloud variant?
If you have any concerns/comments/suggestions please let us know here.
--
[1] https://unbound.net/
[2] http://www.nlnetlabs.nl/projects/dnssec-trigger/
[3] https://lists.fedoraproject.org/pipermail/cloud/2015-July/005590.html
Thank you.
---Regards -P J P http://feedmug.com
_______________________________________________ cloud mailing list
https://admin.fedoraproject.org/mailman/listinfo/cloud Fedora Code of
Conduct: http://fedoraproject.org/code-of-conduct