Using avahi to publish IPV6 DNSservers - Security?

Linux and Unix-Like UNIX and Linux Applications
1

Hello,

we use here internal avahi to publish IPV6 DNSservers. It was the easiest way for us to use the service with radvd. Here is the part from the avahiconf:
publish-dns-servers=IPV6adress-dns-server
This works really fine. But my problem is the security. When you have this config for example in an public locaten. Some go here and broadcast his own dnsserver.

There is some file "/etc/mdns.allow". Here can you set domainnames. But this is only "from this client". For example: "tux.at"
When this is set, only client in the avahi-domain "tux.at" are dissolvable.

But what I would like to know is, is there a place on the client where i can set the IPadress of the server that is allowed to publish his dnsservers?

Thanks for help
Best Regards

2

As far as I know, no. Avahi was not designed with security as a priority.

3

Yes, i know. But i don't know i can publish IPV6 DNSserver without it. Is it possible to use an IPV6 DHCPserver only for DNS?

Best Regards

4

changed to an Layer3 Switch. HP2920. It gives all clients an IPV6 DNS over Router Advertisements. I think this is the better way.

Best Regards