|
|||
|
dns server recursive lookups bad?
DNS report reports:
Test Name: Open DNS servers Status: Fail ERROR: One or more of your nameservers reports that it is an open DNS server. This usually means that anyone in the world can query it. This can cause an excessive load on your DNS server. Also, it is strongly discouraged to have a DNS server be both authoritative for your domain and be recursive (even if it is not open), due to the potential for cache poisoning (with no recursion, there is no cache, and it is impossible to poison it). Also, the bad guys could use your DNS server as part of an attack, by forging their IP address. Problem record(s) are: Server x.x.x.1. reports that it will do recursive lookups. Server x.x.x.2. reports that it will do recursive lookups. Server x.x.x.3. reports that it will do recursive lookups. I believe this used to be listed as a warning since I setup my cpanel server two years ago but I never thought much of it. Now that they have changed the status to fail I assume they are aware of real-world problems caused by it more than just a tiny tiny bit of load. 1.) is setting named to allow recursive lookups the default for cpanel? Or have I done something wrong. 2.) are people following dnsreport.com's advice now and turning recursive lookups off so cpanel dns will only reply for domains specifically hosted by our servers? 2.) how would this be done? |
|
||||
|
You can read the CERT explanation here:
http://www.us-cert.gov/reading_room/...sion121605.pdf |
|
|||
|
So what is the correct way to turn off recursion without breaking anything on a whm/cpanel server?
Is this the correct thing to add to the named.conf options { allow-recursion { 127.0.0.1; xxx.xxx.xxx.xxx; }; }; with xxx.xxx.xxx.xxx the server's primary IP used for exim? |
|
||||
|
In addition to 127.0.0.1 that line should include all IPs on the server plus other IPs that you want to allow recursion.
ACLs are another way to handle this. http://www.net.cmu.edu/groups/netdev...9ARM.ch07.html For instance we use this type of config: acl "trusted" { "main server IP"; 127.0.0.1; "name server IP"; "name server IP"; "additional secondary name server IP; "and so on"; }; options { directory "/var/named"; version "not currently available"; allow-recursion { trusted; }; allow-notify { trusted; }; allow-transfer { trusted; }; }; Last edited by sawbuck; 03-02-2006 at 03:23 PM. |
|
|||
|
I just noticed the same thing when I was performing a DNS check on one of my domains.
Sawbuck The example config you provided...is that intended for named.conf or is it for another file? Also, I'm assuming it would go before everything else. |
|
||||
|
Thanks all, this is very useful info.
Verdon, bearing in mind that I am not the Bind expert here, I wonder if your allow-query { trusted; }; entry is not too restrictive. Does that not block all queries from outside?
__________________
Stephen @ ANNO Internet |
|
||||
|
Quote:
Yes, I believe that it would. I guess that I'm just wondering out loud, which outside queries I would want to allow? I was working from the example here http://www.net.cmu.edu/groups/netdev...9ARM.ch07.html |
|
|||
|
does it matter where in named.conf this is placed?
Quote:
|
|
|||
|
Quote:
|
|
||||
|
Quote:
http://www.linuxsecurity.com/resourc...ame_server.pdf |
![]() |
| Thread Tools | |
| Display Modes | |
|
|