Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a cluster of servers running Xenserver 5.6 that host web email and VoIP services. I'm currently considering setting up a chrooted bind server on each Xenserver host (I mean on the actual server not inside a VM)

Is this a bad idea?

share|improve this question

2 Answers 2

As a general rule, I'd advise against running anything other than the absolute bare minimum of services in the Xen Dom0 (the privileged domain which has full access to the hardware, and to all the virtual machines on the host).

This is primarily on security grounds - you should, as a rule of thumb, only run essential services on the machines which carry the greatest value to you - if your Dom0 is compromised, all your DomUs (guest VMs) are also effectively compromised, as the attacker has access to the console of each VM.

If you do want to run some nameservers, and they're public-facing, and authoritative, there's no problem with running them as virtual machines, but you should make every effort to run them (you always need at least two) on entirely separate network segments to ensure availability. For example:

ns1.redhat.com. 463 IN A 66.187.233.210

ns2.redhat.com. 463 IN A 209.132.183.2

ns3.redhat.com. 462 IN A 209.132.176.100

share|improve this answer
2  
+1 for not running anything other than minimum services on Dom0. –  Josh Brower Jul 11 '10 at 17:35

it can be a good idea for your Virtual Machines, using it as caching and forwarding nameserver. Also, that DNS server can forward request to your upstream provider if needed.

Don't forget to secure the installation inside a chroot and not allow external request to your servers. If you have a firewall, you must allow traffic outgoing on port 53/UDP to upstream if you choose to forward request; 53/TCP is needed in primary/secondary configurations for transfers.

I have some traffic intensive, public DNS servers, running with 256 MB so the footprint is small.

Give it a try!

share|improve this answer
2  
As Stephen said, running anything on the Dom0 is not really a good idea. I don't think I'd recommend someone give it a try on a production box. Also, a basic *nix install with just Bind usually runs comfortably in 64MB of RAM. –  Chris S Jul 11 '10 at 15:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.