I've gotten three queries concerning tinydns - here's a comprehensive
reply I just sent - along with a copy of a message from the author
concerning it. I've deleted all identification marks of the user I
communicated with - id'ed as censored
---------- Forwarded message ----------
Date: Sun, 27 Aug 2000 18:36:51 -0400 (EDT)
From: [EMAIL PROTECTED]
To: -- CENSORED --
Subject: Re: DJB's tinydns??
Hi
It's a good little program - low overhead - very fast. But it's very
different from regular BIND - the file format is eliminated altogether and
you load dns data via a command line interface. i think you can also
edit the files directly - but not sure.
We tested it as an alternative to BIND for serving up whois data via dns.
What it does not have is all the bells and whistles of BIND - but it's a
good workhorse - especially for facilities that want a simple fast dns
solution that is powerful. Example - you dont have to reload or restart
it. Records are updated on the fly.
Also - in the group discussion there has been some mention of tinydns
lacking axfr - true - but he has another program that impliments it if
needed.
here is some data direct from the author - you'll notice i was interested
in it's security.
>From [EMAIL PROTECTED] Sun Aug 27 18:35:17 2000
Date: 19 Apr 2000 01:55:46 -0000
From: D. J. Bernstein <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED], [EMAIL PROTECTED]
Subject: Re: dns cache
http://cr.yp.to/dnscache.html
tinydns works directly from a hashed file on disk. The kernel's buffer
cache tries to keep frequently used blocks in memory. I don't know how
much .com load you could sustain with only 64MB of RAM.
As for security, I'm adding special handling of *.86253547.secure.* as
described in http://cr.yp.to/dnscache/forgery.html so that, for example,
d0409cb9405dbeb286780fce054ddf7e8fa5d5d4.86253547.secure.www.uic.edu
-> 128.248.155.51
isn't accepted without a signature under a public key having hash d04...
On top of this I could add special handling of *.signedby.pccf.net so
that, for example,
www.uic.edu.signedby.pccf.net ->
d0409cb9405dbeb286780fce054ddf7e8fa5d5d4.86253547.secure.www.uic.edu
isn't accepted without a signature under a preconfigured pccf.net key.
Browsers could abbreviate .signedby.pccf.net to save time for users.
---Dan
Joe Baptista
http://www.dot.god/
dot.GOD Hostmaster
+1 (805) 753-8697
On Mon, 28 Aug 2000, -- CENSORED -- wrote:
> Hello Dr. Baptista,
>
> Would you mind telling me what is the DJB tinydns ?
>
> You seem to be pretty satisfied with it.
>
> Thanks in advance and regards
>
> -- CENSORED --
>
> ----- Original Message -----
> From: "!Dr. Joe Baptista" <[EMAIL PROTECTED]>
> To: "Jeremy Hansen" <[EMAIL PROTECTED]>
> Cc: "OpenSRS Discuss-List" <[EMAIL PROTECTED]>
> Sent: Sunday, August 27, 2000 9:24 PM
> Subject: Re: DJB's tinydns??
>
>
> > We have tested it - it's an excellent package.
> >
> > On Sun, 27 Aug 2000, Jeremy Hansen wrote:
> >
> > >
> > > Anyone using DJB's tinydns? I've running it for about 2 months now and
> I
> > > personally think it's great. Just curious if there's anyone on this
> list
> > > using it and their accounts on its performance, etc.
> > >
> > > It's Dan Bertstein, so the security is obvious, even if it does make
> some
> > > things a pain, as in zone transfers.
> > >
> > > -jeremy
> > >
> > > http://www.xxedgexx.com * [EMAIL PROTECTED]
> > > ----------------------------------------------
> > >
> >
> >
>
