David Miller wrote:
>> I don't consider it stealing because I allow zone
>> transfers to any requesting computer.
Len wrote:
> I can steal from .10 also:
>
> # dig @205.217.113.10 rentpro.com axfr
>
> ; <<>> DiG 8.3 <<>> @205.217.113.10 rentpro.com axfr
> ; (1 server found)
> $ORIGIN rentpro.com.
> @ 1H IN SOA ns2.primocomputers.com.
> admin.primocomputers.com. (
> 13 ; serial
> 15M ; refresh
> 10M ; retry
> 1D ; expiry
> 1H ) ; minimum
>
> 1H IN A 205.217.113.227
> 1H IN NS ns2.primocomputers.com.
> 1H IN NS ns1.primocomputers.com.
> 1H IN MX 10 mail
> lists 1H IN A 205.217.113.210
> mail 1H IN A 205.217.113.140
> ns1 1H IN A 205.217.113.10
> ns2 1H IN A 205.217.113.11
> www 1H IN A 205.217.113.227
> @ 1H IN SOA ns2.primocomputers.com.
> admin.primocomputers.com. (
> 13 ; serial
> 15M ; refresh
> 10M ; retry
> 1D ; expiry
> 1H ) ; minimum
>
> ;; Received 11 answers (11 records).
> ;; FROM: mx1 to SERVER: 205.217.113.10
> ;; WHEN: Sun Aug 25 11:59:22 2002
> ...
> As long as you realize you are intentionally making your DNS
> vulnerable to being DoSed.
> ... if you follow my advice, you have time to figure
> out later why my advice is good now.
Ok, I trust you enough that I went ahead and turned off zone transfers for
non-designated computers. However, I still don't fully understand the
problem here with people getting the info. I assume that you consider your
own DNS secure, yet it was easy for me to pull down all the information
about your domain, Go2France.com. Following is what I pulled from your DNS
server about your domain name:
Server: ns1.meiway.com
Address: 212.73.210.69
go2france.com MX preference = 10, mail exchanger = mgw2.meiway.com
go2france.com MX preference = 5, mail exchanger = mgw1.meiway.com
go2france.com internet address = 212.73.210.65
go2france.com nameserver = ns1.meiway.com
go2france.com nameserver = ns2.meiway.com
go2france.com nameserver = as1.meiway.com
go2france.com nameserver = ms1.meiway.com
go2france.com
primary name server = ns1.meiway.com
responsible mail addr = ns-admin.meiway.com
serial = 2002031301
refresh = 86400 (1 day)
retry = 1800 (30 mins)
expire = 864000 (10 days)
default TTL = 86400 (1 day)
go2france.com nameserver = ns1.meiway.com
go2france.com nameserver = ns2.meiway.com
go2france.com nameserver = as1.meiway.com
go2france.com nameserver = ms1.meiway.com
mgw2.meiway.com internet address = 212.73.210.74
mgw1.meiway.com internet address = 212.73.210.75
ns1.meiway.com internet address = 212.73.210.69
ns2.meiway.com internet address = 212.73.210.72
as1.meiway.com internet address = 212.73.210.81
ms1.meiway.com internet address = 212.73.210.73
This seems to be the same kind of information that you pulled from my domain
and then complained about it being a security fault. Does this mean that I
stole this information from you? Is this a bad thing that I can pull this
information about your network? I'm not trying to be argumentative. I just
want to understand fully the security issues.
It seems that you are focusing upon people maliciously dragging down a
system by constantly using its resources. But this can be done for
virtually any internet resource that is open to the public. I can write
something to constantly download in a cycle all the html pages on a web site
and drag it down, or constantly hit a DNS server with queries. If all you
are saying is that we should close as many doors as possible, then I think
you have made your point. If there is something else, let me know because I
do want to fully understand this.
David Miller wrote:
>> Are you familiar with forwarding in Win2k DNS? Isn't this
>> the better answer to this problem, rather than having two
>> DNS servers?
Len wrote:
> if recursion = off, and forwarding = yes is a valid combo,
> then that should work.
Great. I think I'm actually beginning to understand this DNS stuff, thanks
to you. I appreciate your patience with me.
David Miller
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
