Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a cluster of servers running Xenserver 5.6 that host web email and VoIP services. I'm currently considering setting up a chrooted bind server on each Xenserver host (I mean on the actual server not inside a VM)

Is this a bad idea?

share|improve this question

1 Answer 1

As a general rule, I'd advise against running anything other than the absolute bare minimum of services in the Xen Dom0 (the privileged domain which has full access to the hardware, and to all the virtual machines on the host).

This is primarily on security grounds - you should, as a rule of thumb, only run essential services on the machines which carry the greatest value to you - if your Dom0 is compromised, all your DomUs (guest VMs) are also effectively compromised, as the attacker has access to the console of each VM.

If you do want to run some nameservers, and they're public-facing, and authoritative, there's no problem with running them as virtual machines, but you should make every effort to run them (you always need at least two) on entirely separate network segments to ensure availability. For example:

ns1.redhat.com. 463 IN A 66.187.233.210

ns2.redhat.com. 463 IN A 209.132.183.2

ns3.redhat.com. 462 IN A 209.132.176.100

share|improve this answer
2  
+1 for not running anything other than minimum services on Dom0. –  Josh Brower Jul 11 '10 at 17:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.