Nixu Software Web Journal

The more we talk with IT professionals, the more we find virtualized computing environments whose full potential has not been utilized. Although an increasing number of organizations have already committed to virtualization by investing in platforms such as VMware ESX Server and Citrix XenServer Enterprise Edition, these same entities still continue to run a number of applications and network services on traditional hardware platforms. From the business point of view, this doesn’t make much sense as the only way to fully utilize the virtualization investment is to consolidate as many services and applications on these platforms as possible.

This is especially true in computing environments where the traditional servers (or hardware-based computing appliances) are used to run services that are not particularly CPU intensive. For example, if you think about DNS or DHCP servers running on dedicated servers, these services consume a very low percentage of the available resources for 95%+ of the time. And bearing Moore’s Law in mind, the situation is not getting any better going forward. Yet at the same time, running dedicated servers is warranted from the information security point of view, as it makes these servers less compromised to software vulnerabilities. With several services running on single box, a vulnerability in any piece of software will compromise all services running on that server.

This is exactly why running DNS and DHCP servers as virtual machines makes perfect sense: it offers you the best of both worlds. From the information security point of view, a virtual machine (VM) dedicated to a specific service or application is inherently more secure than a general purpose server running several services on single O/S. Further, running dedicated DNS and/or DHCP servers as VMs also allows organizations to optimize the usage of the computing power at their disposal. This is simply because virtualization platforms do not waste CPU resources on dedicated DNS and/or DHCP appliances in the same way as traditional, hardware-based computing appliances do.

To find out where we’re coming from, please have a look at our White Paper on Virtualized DNS and IP Addressing Environments.

Since launching version 1.1 of Nixu DHCP Server in early February, we have been discussing always-on DHCP with dozens of organizations. To sum up these talks, we’ve found that although most entities running Microsoft AD in their network are generally happy with the availability of their DNS service, many of them have suffered from the loss of DHCP service at times. Quite typically, this happens when the operations are scattered around, as Microsoft DHCP servers do not support failover between a number of sites. So in practice, should you loose the Microsoft DHCP server for any reason - or the connection to the data center in which the DHCP server(s) are situated - the dynamic clients in your network will not be able to obtain an IP.

In these cases, we’ve found that the DHCP failover mechanism developed for Nixu DHCP Server 1.1 is ideally suited for network environments such as this, primarily for four reasons:

1. As we rely on network-based API in our DHCP failover mechanism, the two servers in the failover pair can be situated in separate network segments. While this may sound pretty logical at first, commonly used DHCP servers such as ISC DHCPD - or other DHCP products based on it - have actually required both servers in the failover pair to be located in the same network segment, which means that you end up having a pretty substantial number of servers if you want to ensure always-on DHCP in a bigger network. In our case, you can get away in most cases with just one DHCP failover pair.
2. Many of us are running Cisco or Juniper routers in our networks. The beauty of this fact is that both of them support two or more IPs in their DHCP relay configuration option. So in practice, if you run one Nixu DHCP Server in network segment x and another Nixu DHCP Server in network segment y, you can configure the IPs of these two servers in your routers. This makes sure that even if you lost the connection to DHCP server running in network segment x, you will still be able to obtain the IP from server in network segment y.
3. The third point would be ease of management and load-balancing. When running Nixu DHCP Servers as a failover pair, you can manage all configurations from the WebUI of the failover primary: all configurations are pushed automatically to the failover secondary over the network-based API. Further, under normal circumstances, the failover pair does software-based load-balancing which means that you are better equipped to handle sudden traffic peaks after e.g. long weekends when a large number of people return to work.
4. As the fourth point, if your organization is already running virtualization platforms (VMware, XenSource Enterprise Edition, etc.), you do not need hardware to run Nixu DHCP Servers. Just download the ISO installation media (software appliance) from our website and boot up a new vm. Compared to traditional computing appliances, this translates to lower costs and ease of platform maintenance.

Based on the feedback we have received, this approach seems to be the cure for most DHCP headaches. If you’re interested in trying out this approach yourself, you can do so by downloading Nixu DHCP Server for free evaluation from this link.

Some of you may remember my January 15 post on The Long Tail of Networking Software, which was an attempt to explain Chris Anderson’s Long Tail economics in the networking software context. To recap, the point I wanted to make was that the ability to distribute network appliances electronically over the Internet as software appliances (or virtual appliances) is likely to change the traditional distribution and pricing models used by the networking industry, and therefore the way in which networking software will be consumed in the future.

Interestingly enough, on February 25, Chris Anderson introduced his new thesis in Wired Magazine’s article Free! Why $0.00 Is the Future of Business. In this new piece, Chris argues that electronic goods and services that are consumed online and that have a marginal cost of zero, are all heading down the path to gratis. While this notion isn’t exactly controversial for people who have got used to consuming Google’s free tools and services, it’s still quite an intriguing idea. After all, we’ve all been taught that there’s no such thing as a free lunch. But could it be that we’ve all been taught wrong?

Well, I’m not sure about that, but I’m pleased to tell you all that today marks the launch of howismydns.com, an online service designed to validate and check the health of one’s public DNS servers. In addition to the DNS Zone Report tool, the website has also some other useful features such as WHOIS, forward and reverse lookups. The general design principle has been to focus on the essential tools an average DNS admin would find useful rather than including all the bells and whistles in the service. If you asked me, I’d say the DNS Zone Report alone is definitely worth a visit.

Best of all, howismydns.com is free. And by free, we mean absolutely free. There are no limitations as to how often or how many times you may use the service, nor does it require you to submit any information such as email address, phone number or other contact details that pesky sales reps would find handy. Just use it as you like, when you like, to have the health of your public DNS assessed for $0.00.

Last but not least, a word from the sponsor: this free lunch is brought to you by Nixu Software!

Last week marked the release of the new Microsoft Windows 2008 Server with experimental support for server virtualization in the shape of Hyper-V. As I have said here before, we have been convinced that Microsoft’s support will play a large role in server virtualization going mainstream. After all, by the time people have replaced their Windows 2003 Servers with 2008, they all can run software appliances on their Microsoft servers as virtual machines. Then again, this really is old news as Microsoft’s plan and schedule were known well in advance.

But although Microsoft admittedly dominated the media last week with their triple launch on February 27, it was actually VMware that ended up making the most interesting announcements, at least as far as server virtualization is concerned. To welcome Microsoft to the party, VMware had closed deals with all major x86 server manufacturers on factory-installed ESX Servers and announced those agreements at the VMworld Europe 2008 event held in Cannes last week:

• “VMware Announces Agreements to Embed VMware ESX 3i Hypervisor Across Broad Lines of Servers from Dell, Fujitsu-Siemens, HP and IBM”

• “Sun Microsystems and VMware Announce OEM Agreement to Add VMware Virtualization to Sun x64 Server and Storage Portfolio”

If this is not impressive, I don’t know what is! But perhaps even more importantly, this is a clear sign that server virtualization as an industry standard is no longer a question of if - it is a question of when. And this in turn portends a great market for software appliances in the not so distant future, as these two technologies are ideal complements that are likely to gain market share hand in hand.

And on this note, there’s one point I’d like to make to everyone looking at server virtualization: the only way to show ROI on the virtualization investment you make is to consolidate as many network services and applications on your virtualization platform as you possibly can. At Nixu Software, we’re convinced that D-services (DNS, DHCP) and IP address management is a good place to start this work, as these core network services are the lifeblood of virtualized network and computing enviroments. To download a white paper on the topic, please click here.

Some of you may be familiar with a presentation titled “Corrupted DNS Resolution Paths: The Rise of a Malicious Resolution Authority” held by David Dagon, Chris Lee and Wenke Lee from Georgia Institute of Technology and Niels Provos of Google, Inc at Network and IT Security Conference: NDSS 2008. To provide you with a quick summary, their research suggests that there are tens of thousands of rogue DNS servers on the Internet used for various kinds of malicious activities, leading to a rise of “second secret authority” that should scare the living daylights of all of us. For Associated Press’s coverage on the topic, please click here .

Now, it may be just me, but I find it rather interesting that while security professionals all over the world are worried by the “second secret authority” on the Internet revealed by this study, the mainstream media is simultaneously embracing a service called OpenDNS. According to respected publications such as Computerworld, The New York Times, and PC World, OpenDNS is a great “speedup tweak” for anyone who wants to have a quicker name to IP resolution than what one’s own ISP provides. OpenDNS claims that their service makes Internet more reliable, networks more secure, and provides insight into DNS activity. Better yet, the service is offered free of charge so what could possibly be wrong here?

Well, my answer to this would be: several things.

First, as everyone who knows their DNS can tell you, running open recursive DNS servers (i.e. DNS servers that allow anyone, anywhere to perform recursive queries) is one of the most basic DNS security mistakes one can make. It makes the DNS server more prone to cache poisonings and, perhaps even more importantly, can be exploited to amplify Denial of Service (DoS) attacks targeted at other DNS servers. Bearing this in mind, I find it somewhat ironic that OpenDNS advertises the IPs of their open recursive DNS servers (208.67.222.222 and 208.67.220.220) and improved network security on their website.

Second, OpenDNS openly admits that their service manipulates DNS data. Now, although I’m willing to give OpenDNS the benefit of the doubt and trust that their intentions are entirely benevolent, I think this is something that can be likened to the “second secret authority” on the Internet: no matter how good the intentions behind OpenDNS, the DNS data provided by the service has been manipulated in order to generate ad revenue. Paul Vixie has apparently labelled this approach as “typosquatting” and according to Wikipedia, OpenDNS has allegedly intercepted some requests for valid servers by landing a request for google.com on OpenDNS’s own page.

Third, although one can use OpenDNS to block name requests for sites that contain inappropriate content - for example schools using this service could block name resolution to adult entertainment and other websites unsuitable to minors - it does absolutely nothing to prevent an access to an inappropriate website should the user be smart enough to type in the IP address rather than the domain name of the site in his/her browser. Essentially, this service does not actually filter any content or block access to suspect websites as advertised (this should be done on web proxy / caching level) but simply relies on the assumption that people are not smart enough to use IPs as opposed to domain names. If they are, OpenDNS will not be able to do anything about it, as DNS is used only for name to IP resolution (and vice versa).

And so, although it probably is true that OpenDNS may provide a nice “speedup tweak” for someone situated relatively close to their recursive DNS servers, in most cases I would recommend against OpenDNS and sticking to the recursive DNS service provided by one’s own ISP, or to recursive DNS service maintained in-house. After all, using DNS for something it has not been designed for doesn’t come without downsides.

Over the last 10 years or so, a rather substantial number of customers and prospects have asked us about our support for new networking standards such as IPv6 and DNSSEC. In the majority of these cases, we’ve got the impression these questions have been raised because of a low-priority tick-box in the requirement specifications rather than an immediate plan to take these new standards into production. We have of course seen some of our customers starting to operate dual-stack (IPv4 & IPv6) networks - the most advanced as early as 2002 - and use Nixu NameSurfer Suite for the management of DNS and IP address space in these deployments, but I think it would be fair to say it hasn’t been an approach adopted by the mainstream. Things do change, though.

As some of you may have already noticed, ICANN announced about two weeks ago that IPv6 address has been added for root servers in the root zone. As David Conrad from ICANN states in the related announcement, this really is a major step forward for IPv6-only connectivity and the global migration to IPv6. But before we get there, though, there are a couple of other hurdles that we have to pass. After all, as our experience shows, it’s not like everyone has been rushing to build an IPv6 compliant network.

And on this note, it just occurred to me that perhaps virtualization of network infrastructure will play an important part in the IPv6 migration. After all, I’d be willing to bet good money that although the high-end of the enterprise market is likely to proceed with enterprise-class virtualization platforms such as VMware Infrastructure, it will most likely be RHEL 5.1 (and upcoming 5.2) and Windows 2008 Server that are going to take server virtualization mainstream.

Bearing the above in mind, my point is this: while both RHEL 5 Series and Windows 2008 Server support IPv6, I doubt IPv6 support alone will compel organizations to deploy these new platforms. However, the built-in support for virtualization included in both RHEL 5 Series and Windows 2008 Server could just be enough to do the trick - especially as they can be used as virtual server platforms for Nixu NameSurfer Suite and Nixu SNS as well as other innovative software appliances designed to simplify the running of a dual-stack (IPv4 & IPv6) network.

I’m sure this hypothesis will be tested soon enough!

On a somewhat unrelated note, and as some of you may have already noticed, we released a new 1.1 version of Nixu DHCP Server last week. This version includes a support for intelligent DHCP failover pairs where the configurations of both servers are managed from a single WebUI. If you’re interested in further details or a free 30-day evaluation of the product, please click here.

As some of you may have already noticed, RedHat has announced their intention to enter the software appliance arena. Basically, what they expect to do is to introduce a software development kit and Appliance Operating System designed for ISVs (Independent Software Vendors) looking to take their products to market as software appliances.

This is actually something rPath has been up to for already quite some time, and is a nut we at Nixu Software cracked already some 24 months ago: our software appliance has CentOS inside which is automatically hardened during the system install, creating a JeOS (Just-enough Operating System) on which the appropriate applications are auto-installed. Because of this approach, our software appliances can be installed and run on pretty much any x86 platform - whether native hardware or virtualization platform such as VMware, Citrix Xen, RHEL, upcoming Microsoft Viridian / Hyper-V etc. - rather than being restricted to any specific piece of hardware or virtualization gear. Effectively, this makes Nixu Products more versatile than most other software / virtual appliances that require a specific virtualization platform to run on, such as virtual appliances built and certified for VMware.

Anyhow, we were really pleased to see that also RedHat is now entering the software appliance arena, as I’m sure that will help us in educating the market on the software appliance benefits. Having talked quite a bit about them myself, I thought I’d point you all to a new direction for a fresh angle: a blog entry on virtualization and branch-office-in-a-box by Robert Whiteley, an analyst at Forrester.

If Robert’s take sounds interesting, you can try out the branch-office-in-a-box concept already today. To have the basic network services up and running, all you have to do is to install Nixu Secure Name Server (SNS), Nixu DHCP Server, and Vyatta OFR (router, firewall, VPN) as separate virtual machines on a x86 box running VMware Server.

According to an article published by The Register on January 17, a gentleman called David Ritz was fined $60,000 for doing DNS lookups. Apparently, this ruling by District Court, County of Cass, State of North Dakota was largely based on a finding that David had been using zone transfers and Whois service to hack the two authoritative DNS servers of a certain specialist web hosting and Internet services firm. As I really couldn’t believe what I was reading - and based on the comments posted at The Register I wasn’t alone - I decided to have an actual look at the ruling itself. After all, if using zone transfers was a crime, most network and system admins would be looking to do some serious jailtime.

To read the ruling yourself, please click here.

Now, while the merits of this case are certainly debatable, I’ll leave that to others. What I’d like to point out, though, is that the plaintiff in this case - a specialist web hosting and Internet services firm - was running two public, authoritative DNS servers containing confidential DNS data that they did not want to disclose to the public. Yet practically anyone who cared to initiate zone transfers was allowed to do that. In my books, it’s like leaving your door open - not unlocked but wide open - and then being upset about the fact that someone came in. If you asked me, the plaintiff had it coming.

But what strikes me the most is this: although leaving one’s door open for anyone to come in sounds a little gullible to say the least, there are literally millions of public DNS servers out there that have been configured insecurely and are open for anyone to access. Yes, millions. Yet if you asked the system administrators responsible for these DNS servers whether or not their servers were securely managed and configured, they would most likely say ‘yes’ and then share a clever detail or two of the finesses of managing a DNS server. Doesn’t it sound like there’s a bit of a discrepancy at play here?

The reason for the discrepancy is simple enough, though: plain vanilla BIND servers that make up some 80%+ of all public DNS servers come with default configurations that are not secure. And this, my dear readers, is exactly why we developed Nixu Secure Name Server (SNS): to protect your DNS servers by making the related installation, configuration and management processes a walk in the park.

As some of you may have already noticed, we launched the new 6.1.1 version of Nixu NameSurfer Suite yesterday. The most important new feature in this release is full integration with Secure64 DNS server application. If you are not familiar with Secure64 DNS, I strongly urge you to check it out: it is the highest-performing and the most secure authoritative DNS server on the planet.

Now, I guess some of you may wonder the rationale behind our co-operation with Secure64. After all, Nixu Software already has another authoritative DNS server in its solution portfolio, Nixu Secure Name Server (SNS), so one might think there is an overlap between the two products. Nothing could be further from the truth, though.

Nixu SNS is an inexpensive ($495 per server per year) DNS software appliance that offers a good level of security and performance on x86-based platforms, whether x86 hardware or virtualization platforms emulating x86 computing environment. Depending on the exact platform specifications, Nixu SNS can answer up to 30,000-40,000 queries per second. With its hardened Linux OS and built-in intrusion detection / intrusion prevention, it is as secure as a hardened Linux-based server can be. In many cases, this would be enough.

However, there are also some security-conscious service providers, enterprises and other organizations out there that want to go the extra mile to protect their Internet-dependent business under any and all circumstances. And for these folks, there is Secure64 DNS, the DNS marvel. A single entry-level HP Integrity server with Intel Itanium CPU running Secure64 DNS can answer 100,000+ queries per second. Even better, it’s totally immune against all known malware & rootkits and remains responsive until a one-gigabit connection has been saturated. Impressive stuff, no?

So essentially, I think it’s safe to say these two technologies complement rather than compete with each other. But even more importantly, I think we’ve now gone a long way into redefining DNS performance and security with Secure64. As many of you know, some vendors in our industry ship Nixu SNS -like products on Dell boxes and call them high-end. I’m sorry to tell them that’s nowadays just the bare minimum.