>Can't a malicious person do the same thing to BIND?
only if that person is on a subnet that is allowed recursion.
>Ok, I can follow this. But does this really happen a lot?
A famous one was Macdonald's UK last year. The LiOn worm allowed an
attacker to take over MacDo's ISP's DNS and change the A records to some
other. Given the number of illegal ETRN's I see coming into IMGAte
servers, there are tons of people out there who would love to steal your
mail (ssn numbers, credit card numbers, bank accnt numbers, you name). So
if someone can change the A record of your MX hostname, then your incoming
mail goes to the attacker's ip, and you won't ever see that mail.
> How come Serhan
>can use crocodile.ebay.com for his DNS server?
Ask ebay and Serhan.
>Wouldn't they be vulnerable
>to this also? I assume that the scenario you outline here doesn't happen
>much if ebay DNS servers can be used.
ebay or any DNS server can be authoritative for any number of zones. This
has nothing to do with providing recursive queries to Internet
>Len wrote:
> > 3) btw, you also have "zone transfer" unrestricted. I just stole
> > your zone data for rentpro.com:
>
>I don't consider it stealing because I allow zone transfers to any
>requesting computer.
bad idea, for the reasons I listed. As long as you realize you are
intentionally making your DNS vulnerable to being DoSed.
>I've been reading all I can, but puting it all together takes a bit of
>experience which I have not accumulated yet.
sure, it takes time. but if you follow my advice, you have time to figure
out later why my advice is good now.
>Ok, please tell me why I would not want you to have the information that you
>just pulled from my DNS server?
Previously, before powerful PC's and tcp/ip stacks could scan 1000's of ip
for open ports, providing zone transfers was advertizing to hackers the
whole list of ip's to attack. Obscuring your zones by restricting zone
transfers is not real security, but you should deny them any advantage. The
bigger risk is DoSing your DNS with 100's or 1000's of zone transfer requests.
> How could you having any of this
>information hurt me? Again, my whole thinking has been to set this up so
>that others can get this information that you say you "stole" from me.
yeah, well, as you say, you're new to this. There are plenty of black hats
and many more pfy script kiddies ready to take you out just for kicks and
profit. DNS servers, being sine-qua-non infrastructure, are "high value"
targets.
>Incidetally, this is the very DNS server that I am concerned about
>whetherit will work as it should because the IP address for it is an alias
>instead
>of the canonical IP address. It seems to work for you ok. Maybe I
>shouldn't worry about it.
I can steal from .10 also:
# dig @205.217.113.10 rentpro.com axfr
; <<>> DiG 8.3 <<>> @205.217.113.10 rentpro.com axfr
; (1 server found)
$ORIGIN rentpro.com.
@ 1H IN SOA ns2.primocomputers.com.
admin.primocomputers.com. (
13 ; serial
15M ; refresh
10M ; retry
1D ; expiry
1H ) ; minimum
1H IN A 205.217.113.227
1H IN NS ns2.primocomputers.com.
1H IN NS ns1.primocomputers.com.
1H IN MX 10 mail
lists 1H IN A 205.217.113.210
mail 1H IN A 205.217.113.140
ns1 1H IN A 205.217.113.10
ns2 1H IN A 205.217.113.11
www 1H IN A 205.217.113.227
@ 1H IN SOA ns2.primocomputers.com.
admin.primocomputers.com. (
13 ; serial
15M ; refresh
10M ; retry
1D ; expiry
1H ) ; minimum
;; Received 11 answers (11 records).
;; FROM: mx1 to SERVER: 205.217.113.10
;; WHEN: Sun Aug 25 11:59:22 2002
So as long as your DNS is answering at the registered ip, you're
ok. Probably nobody, of good intentions, will query DNS on the other ip's.
>Maybe I'm a little naive. Are you saying that there are people out there
>who don't know me who want to bog down my DNS resources just for the fun of
>it?
I can't say why they would want to do it, but why leave the door to your
house open??
> > ... asking your DNS for YOUR domains is not recursive querying.
>
>I'm getting the picture now. It seems like recursive querying should be
>restricted to computers that I specify be allowed to do it. Does BIND have
>a feature like this?
Yes
>What about turning off recursion and setting up forwarding.
If MS DNS let's you do that, and their is another DNS, like at your ISP,
that allows recursive queries from your DNS, then that would be a solution.
>Len wrote:
> > The problem is querying your DNS for 1000's of non-YOUR domains. So you
> > turn off recursion, and Internet can still query your DNS for your
> > domains. And then Internet cannot query your DNS for other domains.
> > Great. But then YOU can't use your non-recursive DNS for looking up any
> > domains not yours, either.
>
>Unless I specify a forwarder to get the other information, right?
I'm not an expert on the all the combinations of W2K DNS radio buttons that
are valid. Given that MS had obviously done a lot of work on W2K DNS vs
NT4 DNS, I assumed they had allowed for restricting recursion.
> > from Internet to your recursive DNS at your firewall.
>
>Are you familiar with forwarding in Win2k DNS? Isn't this the better answer
>to this problem, rather than having two DNS servers?
if recursion = off, and forwarding = yes is a valid combo, then that should
work.
> > the public DNS.
>
>You certainly build a strong case for using BIND.
well, a case for being aware of W2K DNS problems. BIND would be the easy
alternative, there are some low-priced commercial GUI DNS's for Windows.
Len
__________________________________________________________________
www.menandmice.com/DNS-training : DNS Training
BIND8NT.MEIway.com : ISC BIND for NT4 & W2K
IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
