Skip to content
Register

Setting up secondary DNS with hidden primary

VPS Hosting by emalite 18 replies 2.7K views
emalite

Member OP

Lisbon

#1

So you want the « stealth master »? Tipo, the primary that no one sees? Mas the secondaries do the talking to the world?

1️⃣ setup:
- primary: your box, not in NS records
- secondaries: listed in whois, in the zone, everywhere
- AXFR from primary secondaries only

2️⃣ why: hide the admin interface, tipo, reduce attack surface

3️⃣ my config (bind9):
- allow-transfer { secondary IPs; };
- also-notify { same };
- no NS record pointing home

Tested with the Contabo VPS as primary, the InterServer as secondary. Worked!

Questions?

klaus

Member

yaml victim

#2

Emalite — small Correction Of the Terminology: « stealth master » is not the gemütlich way the RFCs speak. The correct Name is « hidden primary » Architecture. So, na ja, the Function is identical, but in DNS we value Precision Of the Language.

Your Notifies and the Zone Transfers: gemütlich Setup, so far so good.

btrfs

Member

snapshot obsessive

#3

1) terminology correction noted
A) "stealth master" = colloquial
B) "hidden primary" = RFC 6781 section 3.4 -- https://datatracker.ietf.org
2) AXFR verification steps
A) check serial propagation
I) dig @secondary SOA example.com
Ii) compare to primary
B) verify NOTIFY receipt
I) tcpdump port 53
Ii) or check secondary logs
3) common failure mode
A) zone transfers work initially
B) then fail silently for months
I) firewall change
Ii) TSIG key expiry
Iii) serial not incremented

liam_funky

Member

Vancouver

#4

1. Thanks for the guide emalite
2. @klaus is right about terminology
2. A) "hidden primary" is standard
2. B) "stealth master" causes confusion
3. One addition to btrfs's list
3. A) monitor serial numbers
3. B) I use a simple script
3. B) I) checks all secondaries daily
3. B) ii) alerts if serial diverges
4. Without monitoring you won't catch silent failures
5. Ask me for the script if wanted

dave39

Member

1 #5

Yea the hidden primary thing works fine until it doesnt,,,,, I ran one on a scrap gods blessed atom box from 2011 for like,,,,, Three years no issues then one day serials all over the place,,,,, Turns out the secondary at the RackNerd changed their transfer IP and just,,,,, Stopped asking for updates,,,,, No error no nothing just stale zone forever,,,,, Found out because my mail started bouncing,,,,, The scrap gods giveth and they taketh away,,,,,

~~dave

Sven3

Member

Stockholm

#6

Emalite — obviously your "tested and worked" means it will keep working forever, or? /s

I ran hidden primary for two years before I noticed the secondaries were serving a zone from eight months prior. Clearly this is the user error you want to hear about. Or whether you have monitoring? No? How do you say... "skill issue" in Portuguese?

@liam_funky's script is the obvious answer. /s (that one was not sarcastic, actually, but you clearly knew that already)

lookuppierre

Member

#7

@Sven3 oui, the « skill issue », it is the Universal, no?

But for the emalite: I ave the same, the « works on my machine » with the hidden primary. The Vultr secondary, it took the AXFR. The HostHatch secondary, it... how to say... the Silent? For the six months. No log, no error, just the old zone. The Transparency, it was not there.

My Fix: the cron with the dnsviz. The Random Check, it saves the face.

https://dnsviz.net

prix fixe infrastructure: €5/mo
MA

Member

#8

Silent for six months? That's the real nightmare.

KA

Member

#9

I had same at HostHatch, the AXFR just... stops. No warning.

lisbonred

Member

Tiny VPS Club

#10

512MB is plenty for a hidden primary, honestly. Bind9 sits there doing nothing most of the time. My €4 Contabo in Nuremberg runs two zones, never breaks a sweat. The hard part is remembering it exists.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft