[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

securing bind - the answer

Just for anybody that was following my string on how to step up server
that will allow only recursive lookups for itself and no other resolvers,
but answer queries for domains that it is authoritative for...

I managed to lock the server down fairly tightly by doing the following:

acl self {; };
options { 
	directory "/usr/local/named";
	allow-transfer { a.b.c.d; };
	recursion yes;
	pid-file "/usr/local/named/pid/named.pid";
	transfers-per-ns 4;
	transfers-in 16;
	notify yes;
	transfer-format many-answers;
	allow-query { self; };

This is great, but if you implement this, it allows your machine, and only
your machine to make inqueries about domains, both recursive or those it  
is responsible for.

In order to allow for the rest of the world to be able to ask the server
about domains that its authoritative for, I had to add a line to each zone

zone "domain.com" { 
		type master; 
		file "forward/db.domain.com";
		allow-query { any; };

Once this was added, things started looking better. My server was
answering queries for domains it was listed as primary for, as well as
dumping recursive queries from machines that should be doing their own

sandman:~# tcpdump -pn udp and port 53
tcpdump: listening on eth0
00:21:08.026792 > 25321 (28)
00:21:08.026792 > 25321 Refused 0/0/0
00:21:08.866771 > 838 (28) (DF)
00:21:08.866771 > 838 Refused 0/0/0

To unsubscribe, send email to majordomo@luci.org with
"unsubscribe luci-discuss" in the body.