DNS server - secure setup

[Rajasekhar Raman]

Hi,

We are in the process of moving our DNS services from a Windows-based server to a HP-UX machine. I have set up a DNS server, albiet a few years ago. We also need to have it completely secure, i.e. no access except thru Secure Shell, so all the internet services (standard) will be disabled.

Does anyone have any pointers /documents on steps to set up a DNS server and lock it down ?

Thanks

-Shekar Raman

[Kellogg Unix Team]

First of all, congratulations on moving a service away from Windoze to Unix !! -)

If you are planning to install hp-ux 11.11 (which I recommend), then look at HP product called 'Bastille'. It not only secures your server, but also chroots your BIND directory structure.

HTH
...Manjeet

[Rajasekhar Raman]

Unfortunately, our standard is HP-UX 11.00. Does Bastille work on this platform too??

-Shekar

[Kellogg Unix Team]

Yes, Bastille runs on hp-ux 11.0 as well ; here is the link -

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B6849AA

[Bill Thorsteinson]

Should be covered in the previously mentiond documentation, but bind has several parmeters to tighten its security.

Create acls in the bind configuration file. Zone transfers should only be allowed between your dns servers, and perhaps within your own network. The primary DNS should only accept updates from localhost. Secondary servers should only accept updates from the primary (possibly from other secondaries).

If you want dynamic updates from DHCP consider making your DHCP server your DNS server. Only allow the DHCP server to update the appropriate domains.