0

I have taken over the responsibility for an old system. I am planning to get new hardware and decommission this exciting server very soon. In the mean time my hosting-provider is warning me that I am running a dns-server that responds to everyone and can be used in a DNS Amplification Attack.

I understand that the correct option to use in named.conf is "allow-query-cache", the problem is that this option was introduced in BIND 9.4, I am running 9.3.6. What options do I have? If I understand correctly the "allow-query" option will be too restrictive, as I am hosting zones on the dns-server.

I really don’t want to spend too much time fixing this old server as it is headed for the junkyard. Advice?

2 Answers 2

1

Depending on when various features were added, you may not have recourse to all options but generally speaking:

  • If you are operating an authoritative-only server and do not need to answer recursive queries for clients you can turn recursion off completely for all clients using "recursion no;"
  • BIND versions that come from after the introduction of the "allow-recursion" statement allow finer-grained control over which clients are allowed to make recursive queries by allowing you to specify an ACL.

Zytrax's helpful on-line DNS book has some syntax examples that you may find useful.

And good for you for looking for ways to address the problem responsibly. Open resolvers can be easily coopted to cause problems for innocent third parties.

5
  • Thank you for your time to reply. Recursive resolve is being controlled, but the server still allows anyone to look up any other domain.
    – Atluxity
    May 2, 2013 at 5:41
  • Do you mean you're trying to limit the ability to ask queries about the domains for which you're authoritative? "allow-query { acl; };" (but that WILL fail queries that might come to you legitimately if you're listed in the domain's NS records.) May 2, 2013 at 6:03
  • No, I would like to limit the ability to ask queries about the domains for which I am not authoritative.
    – Atluxity
    May 3, 2013 at 11:13
  • Then I don't understand what you mean by "Recursive resolve is being controlled, but the server still allows anyone to look up any other domain." May 3, 2013 at 16:09
  • It seems I misunderstood the term "Recursive resolve", never mind. Thank you
    – Atluxity
    May 6, 2013 at 5:01
0

If you're right that you can't resolve this with BIND 9.3.6 (I'll take your word for it), then I reckon your options are to:

  • Use a different DNS server
  • Upgrade to a newer version of BIND

Of those, a newer version of BIND would probably be easier, as you have the configuration already set up for BIND 9.3. BIND 9.8 and 9.9 can be found in FreeBSD ports, and probably in FreeBSD 7 packages too.

Of course, FreeBSD is no longer supported, and newer version of FreeBSD would provide a newer version of BIND (FreeBSD 9.1 comes with BIND 9.8.3-p4), but if the server is soon to be retired then you might not think it's worth the effort.

1
  • Yeah, I just wanted to be absolutely sure that there wasn't an option I was unaware of. Thank you for your reply.
    – Atluxity
    Apr 30, 2013 at 10:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .