DNS module

[oneitonitram (MrGenius)]

@Andy_Wismer

No one operating a SME wants a fully fledged Authoritive DNS server like BIND.

THiis NethServer 8 · GitHub

And This: Search results for ‘DNS #feature’ - NethServer Community

Would beg to disagree @Andy_Wismer

@Andy_Wismer

No sane person who understands DNS would suggest Technitium as an authoritative DNS server. It just doesn’t cut it! And missing auth? No way this should EVER be a full public facing DNS server. Internal may be ok, but not the Internet! It’s ONLY advantage is it supports LE DNS verification, but no users / groups or ANY form of auth!

No serious Business would consider OPENWRT as a full featured Firewall for their business,
But what Nethserver is doing for it with Nethsecurity would make it akin to being close to OpnSense, and therefore Useable for such scenarios.

The same thing Nethvoice is Doing with Asterix and FreePBX. The claim was never for it to be Used as it is, but use its features, and functions as a base line, since its opneosurce, Maybe it could also benefit from…

The reason why it was ever considered, i guess is because, going by this list its the most full featured DNS server out there
Comparison of DNS server software - Wikipedia
@NLS brought it up, i never even knew it existed before

@Andy_Wismer

BIND and eg PowerDNS are easy to handle, but for MOST users here, DNS is far too complicated.

YEt everyone who hosts a website uses them and has need for them, Businesses using Cpanel, Plesk and other variations use DNS, infact, its the first Authoritative DNS they use, CLoudflare is maybe more complicated for them, or they just want everything within the same host.

For whatever reason, they are.

@Andy_Wismer

Martin here is interested as a hoster, not really as a SME, but a full DNS would only create problems for most SME.

Even if i am asking about it as a hoster, is it a problem?
Wouldnt an SMS just want to register a domain, Setup Nethserver DNS as the Nameserver, and come and manage everything within Nethserver,

They will have their DNS records, Within Nethserver, Mail server, within Nethserver, Nextcloud, within nethserver., WP Website within Nethserver
And for all these services, All they need to do is define the FQDN, and Nethserver will setup all the DNS records for them Automagically, and they don’t have to touch Sh#t

Actually it will Make it much more easier for an SME than any other larger size organisation

@Andy_Wismer

This is the real reason Microsoft started suggesting the really stupid use of .local and .lan. And we have a lot of users from that generation.

And for the new generation, thats why we have this IANA commits to .internal for internal domain - Chat - NethServer Community

@Andy_Wismer

I for one would NOT want a fully fledged DNS server like BIND. I have compiled and used BIND on OpenBSD in the past. One Server = one DNS server service, nothing else!

You wouldn’t, but others would, IS IT NOT that, the reason community members are asking for it, so that, if its implemented in Nethserver, and Especially Nethserver 8, it would be easy to work with; installing managing and using?

@Andy_Wismer

The problem with DNSMASK (Specfically in NS7) was the fact that the GUI only allowed “A” Records, “CNAME” was only possible for NethServer itself (eg virtual hosts). So people created “A” records, instead of using CNAMES.

I dont think that was the only problem, going by the Over 30 Community post requesting DNS*(Not me*)

@Tbaile

Cannot stress this enough, dnsmasq can easily manage all the feature you asked, even the authoritative part, the question is if the UI will support them and the answer is no in this moment.

In regards to Above @Tbaile says at the moment, the UI to handle those, will still not be coming to NS8

So Do we still have the same issues in NS7 carried forward to NS8?

@Andy_Wismer

Anyone handling a public faced DNS server should know and understand what they are doing. The idea that a GUI will help if sometone doesn’t fully understand DNS is pure bullsh"t, and a security concern to most other denizens of the Internet.

Equally, does it mean everyone who does not understand some concepts should never self host any software at all?

I beleive the reason even yourself Andy has the experience you do, is because some tools were availed for you to practise, test, and break, and over time, it was transalted to experience.

Since you have Experience, Why don’t we accord the younger generation the same(being young myself)

@Andy_Wismer

You still don’t seem to understand that Internal and External DNS should be on different systems.

Assumptions again. and at what point does discussing a proper DNS module equate to these sentiments?
I never Host 2 Critical systems on the same Host, Not even the same location. I dont even have a single ISP in my Home. because i don’t put everything in one basket. Someone else might do it, not because they don’t understand security, But have you considered that budget can also be a constraint?

@Andy_Wismer

There is NO problem having whatever internal DNS server handling internal DNS, and a separate DNS for external queries, eg on the same or a different node. This is actually the correct way to handle split brain DNS - which is the proper term for using different subsets of entries for internal and external DNS.

@Andy_Wismer

I do think the full CNAME, PTR, TXT capablities of DNSmask (or the similiar, also used in the past, Unbound) should be exposed to the GUI, but maybe in an “advanced mode” view, for those that need these features.

ATLEAST WE AGREE ON SOMETHING
NEthserver8 being a multi cloud solution, would actually serve pretty well in this regard.

@Andy_Wismer

However, if hacked or compromised, this server has ALL entries, so every internal host and structure of the network is exposed to the hackers. Not Good!

Simple Rule of Thumbs, DO NOT OVERENGINEER for the Future

@Andy_Wismer

The public (Internet) does not “need to know” this information, and does not get it!

And that’s why you have a firewall before your network…