David,
Sunday, August 25, 2002 you wrote:
DM> Can't a malicious person do the same thing to BIND?
Not if properly protected. The point is that MS DNS cannot be
properly protected, recursion is either ON or OFF. There are other
issues with MS DNS too even if the recursion problem didn't exist.
If you can run it behind a firewall then it probably doesn't
matter on any issue. But if you need it for public access then it
does matter.
If you don't like Bind there are others for Windows just
one example being Simple DNS http://www.jhsoft.com/
which previously has enjoyed good reports on this list.
DM> Ok, I can follow this. But does this really happen a lot?
Yes, it does. Very often.
Spammers, hackers, and other malicious users will help
themselves to any resource you do not protect.
DM> How comeSerhan can use crocodile.ebay.com for his DNS server?
DM> Wouldn't they be vulnerable to this also?
Yes, there are public DNS servers.
DM> Ok, please tell me why I would not want you to have the
DM> information that you just pulled from my DNS server? How could you
DM> having any of this information hurt me?
Because any malicious user (hackers, script kiddies, spammers,
e-mail harvesters .. ad infinitum) now know your domains and can
figure out a lot about your network structure.
DM> Maybe I'm a little naive. Are you saying that there are people out
DM> there who don't know me who want to bog down my DNS resources just
DM> for the fun of it?
Are you kidding? You can't be serious.
If you are serious the answer is YES. There are hundreds,
thousands, perhaps millions, of people out there who will take the
utmost pleasure in bringing one or all of your network services to
a stop.
Please believe me that the Internet is a very dangerous place. If
you insist on being naive (or ignorant of the risk) then you will
pay the price.
DM> It seems like recursive querying should be restricted to computers
Yes, that's right. Almost anyone except MS has this feature. It
is amazing they do not.
DM> What about turning off recursion
If you want your mail server to work you will have to give it the
ability to use a recursive dns service.
DM> Are you familiar with forwarding in Win2k DNS?
That's good too but a Different thing. You have to have recursion.
Best wishes,
Terry Fritts
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
