topic Re: Securing HP-UX DNS in Operating System - HP-UX

Securing HP-UX DNS

Michael_423 — Fri, 13 Feb 2004 16:47:51 GMT

We have one DNS server on our network that all the Asian root servers love to send binaries to over port 53. Hence I have the following 2 questions.

2 Questions:

1) Is there a way we can secure the DNS server to reject a DNS response with binary code in it?

2) Is there really some legimate DNS traffic to a BIND server that should be from a root server? Or in other words, is there going to be any problems if we start blocking this type of traffic.

Michael

Re: Securing HP-UX DNS

Martin P.J. Zinser — Fri, 13 Feb 2004 17:13:59 GMT

Hello Michael,

you might get a useful answer here (a number of experienced UX folks frequent this Linux forum) but if you want to discuss hpux specific details you might be better off over in the hpux forum at

http://forums1.itrc.hp.com/service/forums/familyhome.do?familyId=117

All the best,

Martin

Re: Securing HP-UX DNS

Steven E. Protter — Sat, 14 Feb 2004 23:15:30 GMT

1) I properly configured DNS server with BIND 9.2.0 will not allow tranfers of binaries. It will only answer valid requests for name resolution infomration.

2) BIND is DNS DNS is BIND. Two names for the same thing.

I do not believe you need to do anything to the BIND version from software.hp.com to secure it against this kind of attack.

Do you have any evidence that this has been done to your servers?

In the HP-UX security section http://forums1.itrc.hp.com/service/forums/categoryhome.do?categoryId=155 you will see posts by Berlene Herren. She has posted a number of DNS/BIND security warnings in the past month. Following the instructions there will leave you secure.

SEP

Re: Securing HP-UX DNS

Paul Cross_1 — Mon, 16 Feb 2004 10:35:05 GMT

BIND is DNS, but DNS isn't BIND...

Re: Securing HP-UX DNS

Steven E. Protter — Mon, 16 Feb 2004 11:03:08 GMT

Yes, I realized after my post that you don't need BIND to do DNS. DNS 4.9 was not BIND and Microsoft does it quite nicely without BIND.

Thanks for the correction.

I'm asking HP to move this thread to HP-UX.

SEP