nixCraft

Hello All,

I am a new member to Nixcraft....

However I am "no new B" to linux and UNIX. Today my company lost our main DNS server due to hardware issues. The server is a RHEL 4 server running BIND....

The question that I have is? I installed and configured a replacement of this system with RHEL5 and BIND version - bind-9.2.4-28 today.

The server is querying great. And logs are happy.

The Question I have is?


I have heard so much gossip in relation to cache poisoning..... I am nervous that our system is not up to par in regards to a attack.

From a unix/linux expert opinion, what is the best steps to make sure we are safe?

I was told from our CTO that due to the fact we are running that version of bind we are safe.

I am not convinced. Now keep in mind, this system is located at LEVEL3 NYC behind a Tipping Point IPS and a Juniper ISG -1000.

But am I really safe to cache poisoning? Is my server safe?



Please have fun with this!! I would love all your opinions!!!

Jaysunn

Run the following command to see if dns server open to such attack or not:
Make sure following two line does NOT exists in your named.conf:
See Find Out If My DNS Server Free From DNS Cache Poisoning Bug Or Not

A few tips to secure named:

1. Hide bind version (see How To Hide BIND DNS Sever Version)
2. Run named in chrooted jail
3. Run updated version (yum update)
4. Configure TSIG to avoid caching while makeing zone trasfer between your own nameservers (see Restricting zone transfers with IP addresses in BIND DNS Server)
5. Turn on security logs
6. Turn on dns queries
7. Configure firewall to protect named
8. Run separate dns servers for extermal and internal queries with the help of zones
9. Disable dynamic updates

__________________
Vivek Gite
Linux Evangelist
Be proud RHEL user, and let the world know about your enterprise choices! Join RedHat user group.
Always use CODE tags for posting system output and commands!
Do you run a Linux? Let's face it, you need help

shine:~ jasonralph$ dig +short @xxx.xxx.xxx.xxx porttest.dns-oarc.net txt
porttest.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e .d.c.b.a.pt.dns-oarc.net.
"xxx.xxx.xxx.xxx is GREAT: 26 queries in 1.9 seconds from 26 ports with std dev 17681"
shine:~ jasonralph$



Also I have confirmed that both those lines did not exist in my nmaed.conf.

Thanks,
I am still working on the rest of your advise.

Jaysunn