David wrote: >> I'm not sure I understand you here. >> What's wrong with others using my DNS?
Len wrote: > 1) malicious "users" could DoS your DNS by sending 1000's queries/minute > with some kiddie script, queries from spoofed ip's (DNS queries are UDP and > therefore the source address is easily spoofable) for non/existant domains, > which your compliant DNS would try to resolve, building its cache up > until...., and probably exhausting the DNS resources for your valid users. Can't a malicious person do the same thing to BIND? Len wrote: > 2) MS DNS's caches are poisonable out of the box. By allowing recursion, > you are allowing attackers the "triggered poisoning" attack: they query > your DNS to for a domain hosted by their cracked DNS that gives your DNS > bad records in the "additional section" of DNS response packet when your > DNS queries their. You can fix this by hacking your DNS registry entries > with articles on MS site. Ok, I can follow this. But does this really happen a lot? How come Serhan can use crocodile.ebay.com for his DNS server? Wouldn't they be vulnerable to this also? I assume that the scenario you outline here doesn't happen much if ebay DNS servers can be used. Len wrote: > 3) btw, you also have "zone transfer" unrestricted. I just stole > your zone data for rentpro.com: I don't consider it stealing because I allow zone transfers to any requesting computer. Len wrote: > # dig @205.217.113.140 rentpro.com axfr > > ; <<>> DiG 8.3 <<>> @205.217.113.140 rentpro.com axfr > ; (1 server found) > $ORIGIN rentpro.com. > @ 1H IN SOA ns2.primocomputers.com. > admin.primocomputers.com. ( > 13 ; serial > 15M ; refresh > 10M ; retry > 1D ; expiry > 1H ) ; minimum > > 1H IN A 205.217.113.227 > 1H IN NS ns2.primocomputers.com. > 1H IN NS ns1.primocomputers.com. > 1H IN MX 10 mail > lists 1H IN A 205.217.113.210 > mail 1H IN A 205.217.113.140 > ns1 1H IN A 205.217.113.10 > ns2 1H IN A 205.217.113.11 > www 1H IN A 205.217.113.227 > @ 1H IN SOA ns2.primocomputers.com. > admin.primocomputers.com. ( > 13 ; serial > 15M ; refresh > 10M ; retry > 1D ; expiry > 1H ) ; minimum > > ;; Received 11 answers (11 records). > ;; FROM: some.where to SERVER: 205.217.113.140 > ;; WHEN: Sun Aug 25 09:14:37 2002 > > You can restrict zone transfers with MS GUI. If you don't know > anything about DNS, at least read all the F1 help screens for all > the MS DNS GUI panels. I've been reading all I can, but puting it all together takes a bit of experience which I have not accumulated yet. Ok, please tell me why I would not want you to have the information that you just pulled from my DNS server? How could you having any of this information hurt me? Again, my whole thinking has been to set this up so that others can get this information that you say you "stole" from me. Incidentally, this is the very DNS server that I am concerned about whether it will work as it should because the IP address for it is an alias instead of the canonical IP address. It seems to work for you ok. Maybe I shouldn't worry about it. Len wrote: > 4) btw, zone transfers are TCP sessions, so it's MUCH easier to exhaust > your DNS' resources with 1000's of zone transfers than it is with UDP queries. Maybe I'm a little naive. Are you saying that there are people out there who don't know me who want to bog down my DNS resources just for the fun of it? Len wrote: > ... asking your DNS for YOUR domains is not recursive querying. I'm getting the picture now. It seems like recursive querying should be restricted to computers that I specify be allowed to do it. Does BIND have a feature like this? What about turning off recursion and setting up forwarding. Seems like that would make Win2K DNS secure, yet still able to respond to local queries for domains outside the local network. This stuff is starting to make sense now. Len wrote: > The problem is querying your DNS for 1000's of non-YOUR domains. So you > turn off recursion, and Internet can still query your DNS for your > domains. And then Internet cannot query your DNS for other domains. > Great. But then YOU can't use your non-recursive DNS for looking up any > domains not yours, either. Unless I specify a forwarder to get the other information, right? Len wrote: > So you really need TWO MS DNS's (licenses for two W2K servers, > are you getting the picture? :)) ). The light is coming on now. Thanks. Len wrote: > One DNS is authoritative for your domains with recursion > (and zone transfer) off and accessible from Internet. The > other DNS has no domains, but has recursion on, aka > "caching-only nameserver". You will have to block access > from Internet to your recursive DNS at your firewall. Are you familiar with forwarding in Win2k DNS? Isn't this the better answer to this problem, rather than having two DNS servers? Len wrote: > So to answer the original poster's question: Yes, it really is That Bad. > Don't deploy it in any scenario where it can talk to servers that you > don't run, because it still causes an incredible slice of brokenness in > the public DNS. You certainly build a strong case for using BIND. Thanks for the information. I still have a lot of reading to do before I decide for sure that I need to drop Win2k DNS and use BIND instead. David Miller To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
