dns

[Kevin Wright]

I have configured a primary server,using bind 4.9, (I have to work with what they ginve me)and have the secondary with an isp.They have pulled a copy of my data successfully. Do I need to do anything on my end to prevent anyhost from pulling a copy of my zone? I think this can be a security risk.

[Fred Martin_1]

I may be wrong but once the data is passed to your ISP it's available there, anyway.

However - your firewall should prevent anyone but your ISP from getting DNS information. Most firewalls allow filtering packets by port number, source address and destination address.

So outbound DNS packets (port 53) with your DNS server (source) and your ISP's DNS server (destination) would be allowed by the firewall, all other port 53 packets would be denied.

It's somewhat more complicated than that, but there's excellent info starting on p.278 of the O'Reilly book "Building Internet Firewalls" if you need it.

[Kevin Wright]

Unfortunately, this box is outside the firewall.

[Rick Garland · Accepted solution]

You can add directives that will only allow certain IP addresses to access the data.

[Kofi ARTHIABAH]

modify your /etc/named.boot file and add an entry for xfernets with the IP address of your ISP's dns server:

echo "xfernets XX.XX.XX.XX" >> /etc/named.boot

then restart your name server.
/sbin/init.d/named stop ; /sbin/init.d/named start.

Do a man on named