从 .NET 应用程序添加 DNS 记录
我正在开发一个我们从另一家公司收购的网络应用程序。 当您“注册”时，服务器应该使用 WMI 创建 DNS 别名。 它因“一般错误”而崩溃，后来通过将以下标记添加到 Web.config 文件来解决：
identity impersonate="true" userName="administrator" password="theadminpass"
这有效，但由于某种原因它现在已经损坏了，显然从安全角度来看我不喜欢它。 我已经使用WMI管理工具给予root\microsoftdns对admin、网络服务、网络和aspnet的完全开放权限，但没有成功。
无论如何，我想知道除了使用 WMI 之外是否还有其他方法可以从 .NET Web 界面中可靠且安全添加 DNS 记录。
I am working on a webapp that we acquired from another company. When you "sign up", the server is supposed to create a DNS alias using WMI. It was crashing with a "Generic Error", which was later cured by adding the following tag to the Web.config file:
identity impersonate="true" userName="administrator" password="theadminpass"
This worked, but for some reason it has since broken, and obviously I don't like it from a security perspective. I have used the WMI management tool to give root\microsoftdns full wide-open permissions to admin, network service, network, and aspnet, with no success.
Anyways, I want to know if there is a way other than using WMI to reliably and securely add DNS records from within a .NET web interface.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您使用的是 IIS 6.1 及更高版本，您可以在应用程序池中设置工作进程的标识。 我发现，使用身份模拟更可靠，它肯定比在配置文件中包含用户名和密码更安全（尽管您可以使用 aspnet_regiis.exe 来加密部分配置）。
至于 WMI 的替代方案，您可以尝试 DnDns 尽管我没有创建 DNS 条目的经验。
If you are using IIS 6.1 and upwards you can set the identity of the worker process within the application pool. I have found that to be more reliable that using idenity impersonation, it is definately more secure than having the username and password in a configuration file (although you can use aspnet_regiis.exe to encrypt portions of the config).
As for an althernative to WMI you could try DnDns although I am not expirienced with creating DNS entries.
（我假设您使用的是 Microsoft 的 DNS 服务器）
您可以设置 DNS 区域的权限，以便运行应用程序池的用户可以创建条目。
(I'm assuming you're using Microsoft's DNS server)
You could set the permissions on the DNS zone so that the user the application pool is running as can create entries.
正确设置 WMI 和 DCOM 权限以通过 WMI 成功更新 MS DNS 可能很困难。 微软似乎在每次修补程序中都让这个问题变得更加困难。
约翰·霍华德有 博客条目 TechNet 上通过 Hyper-V 远程会话处理此问题。 您基本上需要对 MS DNS 执行相同的操作 + 在 DNS 中设置更新权限。
或者，您可能需要考虑使用 Simple DNS Plus 作为 DNS 服务器 - 使用 .NET API 或直接通过 HTTP。
Getting the WMI and DCOM permissions setup correctly to successfully update MS DNS over WMI can be difficult. It seems MS is making this harder with each hotfix.
John Howard has a blog entry on TechNet that deals with this for with Hyper-V remote sessions. You basically need to do the same for MS DNS + set the update permissions in DNS.
Alternatively you may want to consider using Simple DNS Plus as the DNS server - this is much simpler to update remotely either with the .NET API or over HTTP directly.