>Ok, I trust you enough that I went ahead and turned off zone transfers for >non-designated computers.
good for you. > However, I still don't fully understand the >problem here with people getting the info. I assume that you consider your >own DNS secure yes >yet it was easy for me to pull down all the information >about your domain, Go2France.com It's a database server, if you query it, it answers. You did not succeed in ZONE TRANSFER, which is the specific item your DNS did allow, and which my DNS forbid. >This seems to be the same kind of information that you pulled from my domain >and then complained about it being a security fault. not at all. you did not obtain that information by zone transfer, but by simple querying. >Does this mean that I >stole this information from you? of course, but your fishing expedition didn't get ALL the zone records, and got none by zone transfer. >Is this a bad thing that I can pull this >information about your network? absolutely not. DNS is a database server, query it, and it responds. >I'm not trying to be argumentative. I just >want to understand fully the security issues. read my earlier messages. I said unrestricted "zone transfers" were a DoS vulnerability. Try to do a zone transfer with my zones. >It seems that you are focusing upon people maliciously dragging down a >system by constantly using its resources. ... via zone transfers, and/or by unrestricted recursive queries by all of Internet. >But this can be done for >virtually any internet resource that is open to the public. You are beginning to understand that there a finer points to be appreciated. Nobody can totally stop abuse. and DoS attacks are always a bitch to defend against. But you sure can minimize your risk, close all the commonly known doors and vulnerabilities. > I can write >something to constantly download in a cycle all the html pages on a web site >and drag it down, or constantly hit a DNS server with queries. yep. DoS's are very hard to defend against. My point is "why make yourself more vulnerable than necesssary?" >If all you are saying is that we should close as many doors as possible, >then I think you have made your point. ok. > If there is something else, let me know because I >do want to fully understand this. You're doing the good work of understanding it. and maybe some lurkers are, too. Len __________________________________________________________________ www.menandmice.com/DNS-training : DNS Training BIND8NT.MEIway.com : ISC BIND for NT4 & W2K IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
