Bind 4.9 security concern

[Bosco Tsang]

Yes, still 4.9 (see my other post for upgrade issue), and I would like to know if there is anyway to restrict access to our testing subnet only, so no outsider can use this dns server?

[Shannon Petry]

Bind 8.9+ does support ACL's restricting who can get DNS information from the server, including standard lookups.
OLD bind does not do this.

sendmail.org has lots of documentation on using ACL's with DNS, as well as for fee installation support. You should also get "DNS and BIND" by O'Reilly and Associates. SHows you how to use the ACL features, and many other features of bind 8.9+.

Regards,
Shannon

[Bosco Tsang]

I know, but my problem is I cannot upgrade my 4.9 to 8.9+ (see my other posting). We are running 8.9+ on Solaris box. But I need some virtual host testing on this HPUX box (don't want to touch the productional dns) thus run into this problem. Thus, I will need information on 4.9.

Thanks anyway.

[Shannon Petry]

Maybe I was not clear enough in my answer.

There is no possible way to ACL lookups in 4.9. This feature was not made available until version 8.8(I think), and 8.8 was quicky discarded due to security concerns and migrated to 8.9.

If you want not to allow external lookups, an alternate test method would be to setup a dummy DNS zone or two on an internal server to test. Perhaps setup an internal box which will forward to the real server, and have a dummy zone as well for testing.

But again, with 4.9 your stuck with open lookups!

Regards,
Shannon

[Christopher Caldwell]

Use ipfilter

see
http://software.hp.com

or, since you're on a subnet, put a DNS ACL on the router for that subnet.