Securing - optimizing BIND

[open DNS server]

This post is regarding a low risk vulnerability in DNS servers called open DNS server. When a DNS server is open, means that it will serve DNS lookups for domains that do not exist in its own files. So for instance if your DNS server is open, it will give you a response for google.com and any other site that is not hosted in your box.

This is not actually a vulnerability, but when your DNS server is open, it can degrade performance of your DNS, and can cause your DNS servers to be used in an DOS attack.

So in order to close that you need to add this directive in your named.conf file in the options clause :

Code:

recursion no;

But wait a minute. This can cause a bigger problem. With no recursion your server wont be able to get DNS resolves so it wont be able to fetch data from the internet. So I guess this directive wont work well for most of the servers.

If that could be a problem to you, you can use this directive (instead of "recursion no") which will allow recursion to any ip range you want to.

Code:

allow-recursion {127.0.0.1; 192.168.0.1; };

Be sure to add a semicolon ( after each ip because BIND is very hard with directives and it wont work on any error

Hope you liked this small tutorial

Nice article. I don't really understand why recursion no; isn't the standard option and you have to activate it if you really want your DNS to be open.

/Andreas

[Free WordPress Themes]

is it possible to test if my server has some open DNS?

At dnsstuff.com I got a warning about that for one of my NS, but that was before they started charging for access to their tools You only get 10 tries after that you have to be a member.

/Andreas

[Free WordPress Themes]

yes right (that suxxx). I used that test always until they changed that

I guess there is some Linux command but which one?

[Join us @ facebook]

You can still check using dnsstuff. Check http://www.dnsstuff.com/tools/dnsreport.ch?domain=YOURDOMAIN_HERE

Andreas, if you use recursion no, then the server wont be able to get dns records and download things from internet. For instance remote file_get_contents() and Curl will stop working.

[Free WordPress Themes]

thanks to this tutorial my open DNS server is closed now (thanks!)

[Guest]

[43.771]

Yahoo crawler, Googlebot, Msnbot, Baidu Spider, netplayer