Stop BIND server forwarding

[support_5]

Dear all,

I have to use a bind 4.9.2 server. I know it is a bad idea - not my choice.

I do not want this server to be doing forwarding.

Is there a way of stopping it trying to reach the root servers when no forwarder is listed.

Cheers,

Damo

[Steven E. Protter · Accepted solution]

Remove the root servers from the configuration files in

/etc/named.data

One problem though, you'd better take a backup because you might break the server anyway.

More basic question: Why is this box acting as a dns server anyway?

By disabling this functionality, you are stripping it of much functionality. You could not run the named service at all and just do the following:

1)

/etc/resolv.conf
nameserver ip_of_real_dns

2)
/etc/nsswtich.conf

Have dns listed first.

do a nslookup to see if anything his resolved.

Lastly, if you must used named, you are using a very old version with lots of serious security flaws.

You are better off upgrading to BIND 9.2.1

For HP-UX 11.00 or 11.11
https://payment.ecommerce.hp.com/cgi-bin/swdepot_parser.cgi/cgi/try.pl?productNumber=BIND9.2&date=


BIND 8x for 10.20 or lower. Read carefully, there are prerequisites.

http://www.software.hp.com/products/DNS_BIND/index.html

My point is if you strip out the functionality of BIND, why are you running it. This directive is clearly driven by security. If so, you might be better off without running BIND at all.

P

[Marius Paulauskas]

I'd rather use "forward-only" directive. This setup makes sense though - when you only want to service internal zones which are not visible from outside for instance.YOu should specify forwarders list and use directive "forward-only". This makes sure your server will only resolve using forwarders you specify and will NEVER try to resolve anything recursively, querying root or other servers. In this setup first BIND will look for answer in its cache and, if not found, will try forwarders, if not found again it will answer NXDOMAIN.

regards,
/Marius