topic Re: dns in Operating System - HP-UX

dns

Kevin Wright — Thu, 09 Nov 2000 23:12:11 GMT

I have configured a primary server,using bind 4.9, (I have to work with what they ginve me)and have the secondary with an isp.They have pulled a copy of my data successfully. Do I need to do anything on my end to prevent anyhost from pulling a copy of my zone? I think this can be a security risk.

Re: dns

Fred Martin_1 — Fri, 10 Nov 2000 12:38:41 GMT

I may be wrong but once the data is passed to your ISP it's available there, anyway.

However - your firewall should prevent anyone but your ISP from getting DNS information. Most firewalls allow filtering packets by port number, source address and destination address.

So outbound DNS packets (port 53) with your DNS server (source) and your ISP's DNS server (destination) would be allowed by the firewall, all other port 53 packets would be denied.

It's somewhat more complicated than that, but there's excellent info starting on p.278 of the O'Reilly book "Building Internet Firewalls" if you need it.

Re: dns

Kevin Wright — Fri, 10 Nov 2000 15:43:23 GMT

Unfortunately, this box is outside the firewall.

Re: dns

Rick Garland — Fri, 10 Nov 2000 15:49:18 GMT

You can add directives that will only allow certain IP addresses to access the data.

Re: dns

Kofi ARTHIABAH — Fri, 10 Nov 2000 16:29:06 GMT

modify your /etc/named.boot file and add an entry for xfernets with the IP address of your ISP's dns server:

echo "xfernets XX.XX.XX.XX" >> /etc/named.boot

then restart your name server.
/sbin/init.d/named stop ; /sbin/init.d/named start.

Do a man on named