Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a server which I host my company website as well as some of my clients. I noticed a domain which I created, but never used, was being attacked by a poke and hope hacker. I imagine that the hacker collected the domain from either hitting my DNS server and requesting what domains are hosted.

So, in the interest of prevention and better server management, how would I ask my own DNS server (Linux CentOS 4) what sites are being hosted on it?

Also, is there a way to prevent these types of attacks by hiding this information? I would assume that DNS servers would need to keep some information public, but I'm not sure if there is something that most hosts do to help prevent these bandwidth wasting poke and hope attacks.

Thanks in advance.

UPDATE I realized something in reviewing this further, I saw that in this particular case the attack was not brought on by DNS queries (what ever it would be called), rather a dedicated IP. The account I was concerned with hosts a database for a major website, but contains nothing else. I originally gave the account a dedicated IP and obviously that allowed IP walkers to poke and hope.

The actual (and now better clarified) question remains though, how would or could someone (that doesn't have server access) gather the sites which your DNS server represents?

share|improve this question

migrated from stackoverflow.com Apr 17 '10 at 6:19

This question came from our site for professional and enthusiast programmers.

add comment

3 Answers 3

Since it's your own server, you can look at the configuration files and see what domains you're hosting:

The nameserver program should be Bind, and the configuration file for it would normally be:

/etc/named.conf

That file, named.conf will contain a few lines for each domain you're hosting. Look for something like:

zone "example.com" IN {
  type master;
  file "example.com.zone";
  allow-update { none; };
};

As for preventing the attacks by hiding the information, that probably won't work. If a hacker can find out your domain name, he can find the IP address of your name server - that's the whole point of DNS, after all.

If you remove (or comment out) the zone entries in named.conf for your unused domains, you'll partially block those attacks.

share|improve this answer
    
Or named.conf.local which is the preferred place for customisations to the named.conf file. –  kaerast Apr 17 '10 at 9:20
    
Thanks for responding Kaerast, but I was looking to see if there was a way an outsider could retrieve a list of domains controlled by a DNS server. I already know about the hosts file and the basics of DNS and TCP/IP as well. –  Exit Apr 17 '10 at 11:52
add comment

I imagine that the hacker collected the domain from either hitting my DNS server and requesting what domains are hosted.

Why you imagine this? I mean, I would think first the attacker got the DNS from the published official DNS List in the whois database at the registry, asking "ok, who owns the domain" and "what dns servers are registered for it".

share|improve this answer
    
Exactly. The domain was found first, then the DNS server. –  John Gardeniers Apr 17 '10 at 7:18
    
If zone transfer is enabled to any host, then the DNS server may have been located first (unlikely though) –  Mark Henderson Apr 17 '10 at 7:34
    
Haredly. Remember for zone transfer you need to know the zone name first. This means not only scanning ip addresses for DNS server, but also then asking for all zones. Makes no sense. THis attack started on the registry information. –  TomTom Apr 17 '10 at 8:27
    
In response to TomTom, the domain was a subdomain, so it wasn't something that could be found from a Whois record. I didn't originally specify this as I was trying to focus on the how rather than the why. The 'how' is how could some one request a list of all DNS zones from a DNS server. The 'why' is that I want to know what is possible regarding searching a DNS server. With this knowledge, I can better understand potential risks. –  Exit Apr 17 '10 at 8:42
    
@Exit, I think you may have missed a rather important point. There is no request you can make of a DNS server to have it reply with all the domains it hosts. Domain or subdomain, makes no difference to the order the information was found, excluding a random stumble of course. –  John Gardeniers Apr 17 '10 at 10:50
show 4 more comments

Many have focused on the background information and picked that apart rather than attempt to answer the actual questions. I have been actively seeking an answer rather than sit back and wait and have come up with partial answers.

The actual (and now better clarified) question remains though, how would or could someone (that doesn't have server access) gather the sites which your DNS server represents?

Partial answer: If the BIND configuration (etc/named.conf) has 'allow-transfers' set to 'any', then it is possible for outside sources to get a complete list of zones (domains). How this is executed is still unknown.

Also, is there a way to prevent these types of attacks by hiding this information?

Yes, by ensuring only a trusted group has access to 'allow-transfers'. In named.conf, use an acl block (Access Control List/Access Control Statement) to define which IP addresses should be given access will block unauthorized access. To set up an acl:

acl <acl-group-name> {
<ip-address>;
[<ip-address-2>; ...]
};

Replace with a name such as trusted and list the IP or IP ranges (CIDR block format [/20]) ending with a colon and separated by a line ending. Typically, a trusted list would contain the loopback IP (127.0.0.1), the IP addresses assign in your resolv.conf, and any dedicated IP addresses allocated to your server.

After creating the acl, you can apply it to whichever options you choose. For this, it would be 'allow-transfers':

options {
allow-transfers { <acl-group-name>; };
...
}

If you want to block a specific IP address from accessing your DNS server, you can add a new acl block and add 'blackhole' at the top of your options block in named.conf:

options {
blackhole { <acl-blackhole-name>; };
...
}

This is a partial answer, but the most important part was to ensure that someone can't query the nameserver and retrieve a complete list of zones (domains). I'd still be interested in knowing how to execute a DNS zone transfer.

share|improve this answer
    
No, because while zone transfers will allow someone to see what's in a domain, they won't leak which domains are available for transfer. –  Phil P Apr 18 '10 at 9:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.