Ask a DNS server what sites it hosts - and how to possibly prevent misuse

Question

I've got a server which I host my company website as well as some of my clients. I noticed a domain which I created, but never used, was being attacked by a poke and hope hacker. I imagine that the hacker collected the domain from either hitting my DNS server and requesting what domains are hosted.

So, in the interest of prevention and better server management, how would I ask my own DNS server (Linux CentOS 4) what sites are being hosted on it?

Also, is there a way to prevent these types of attacks by hiding this information? I would assume that DNS servers would need to keep some information public, but I'm not sure if there is something that most hosts do to help prevent these bandwidth wasting poke and hope attacks.

Thanks in advance.

UPDATE I realized something in reviewing this further, I saw that in this particular case the attack was not brought on by DNS queries (what ever it would be called), rather a dedicated IP. The account I was concerned with hosts a database for a major website, but contains nothing else. I originally gave the account a dedicated IP and obviously that allowed IP walkers to poke and hope.

The actual (and now better clarified) question remains though, how would or could someone (that doesn't have server access) gather the sites which your DNS server represents?

Answer 1

Since it's your own server, you can look at the configuration files and see what domains you're hosting:

The nameserver program should be Bind, and the configuration file for it would normally be:

/etc/named.conf

That file, named.conf will contain a few lines for each domain you're hosting. Look for something like:

zone "example.com" IN {
  type master;
  file "example.com.zone";
  allow-update { none; };
};

As for preventing the attacks by hiding the information, that probably won't work. If a hacker can find out your domain name, he can find the IP address of your name server - that's the whole point of DNS, after all.

If you remove (or comment out) the zone entries in named.conf for your unused domains, you'll partially block those attacks.

Answer 2

I imagine that the hacker collected the domain from either hitting my DNS server and requesting what domains are hosted.

Why you imagine this? I mean, I would think first the attacker got the DNS from the published official DNS List in the whois database at the registry, asking "ok, who owns the domain" and "what dns servers are registered for it".

Answer 3

Many have focused on the background information and picked that apart rather than attempt to answer the actual questions. I have been actively seeking an answer rather than sit back and wait and have come up with partial answers.

The actual (and now better clarified) question remains though, how would or could someone (that doesn't have server access) gather the sites which your DNS server represents?

Partial answer: If the BIND configuration (etc/named.conf) has 'allow-transfers' set to 'any', then it is possible for outside sources to get a complete list of zones (domains). How this is executed is still unknown.

Also, is there a way to prevent these types of attacks by hiding this information?

Yes, by ensuring only a trusted group has access to 'allow-transfers'. In named.conf, use an acl block (Access Control List/Access Control Statement) to define which IP addresses should be given access will block unauthorized access. To set up an acl:

acl <acl-group-name> {
<ip-address>;
[<ip-address-2>; ...]
};

Replace with a name such as trusted and list the IP or IP ranges (CIDR block format [/20]) ending with a colon and separated by a line ending. Typically, a trusted list would contain the loopback IP (127.0.0.1), the IP addresses assign in your resolv.conf, and any dedicated IP addresses allocated to your server.

After creating the acl, you can apply it to whichever options you choose. For this, it would be 'allow-transfers':

options {
allow-transfers { <acl-group-name>; };
...
}

If you want to block a specific IP address from accessing your DNS server, you can add a new acl block and add 'blackhole' at the top of your options block in named.conf:

options {
blackhole { <acl-blackhole-name>; };
...
}

This is a partial answer, but the most important part was to ensure that someone can't query the nameserver and retrieve a complete list of zones (domains). I'd still be interested in knowing how to execute a DNS zone transfer.