Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently installed Bind on a CentOS box. Everything appears to be working with only port 53 open. However, I noticed in the config file that there is a line in rndc.conf that says "default-port 953;" I don't have port 953 open and Bind appears to be working. Can I keep 953 closed? What is the point of RNDC listening on 953?

share|improve this question

3 Answers 3

up vote 1 down vote accepted

What does this print?

$ sudo netstat -ntlp | grep ':953\>'

It should print something like:

tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      1234/named

or this if you have IPv6 enabled:

tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      1234/named
tcp        0      0 ::1:953                 :::*                    LISTEN      1234/named

Because it uses only the loopback address, the port is only accessible to users logged on to the server itself, not from elsewhere on the network.

rndc is used to manage the name server, for example "rndc reload" is the preferred way to tell BIND that you changed a zone file and it should re-load them.

On my Debian server (not sure about CentOS) it is also required by /etc/init.d/bind9 to start and stop the service. I think CentOS calls that file /etc/init.d/named. I wouldn't disable it or block it without checking how that script works first.

The full list of commands you can run is in the BIND 9 Administrator's Reference Manual - Administrative Tools.

As to why it uses a TCP port, run "man rndc" for the details:

   rndc communicates with the name server over a TCP connection, sending
   commands authenticated with digital signatures. In the current versions
   of rndc and named, the only supported authentication algorithm is
   HMAC-MD5, which uses a shared secret on each end of the connection.
   This provides TSIG-style authentication for the command request and the
   name server’s response. All commands sent over the channel must be
   signed by a key_id known to the server.

   rndc reads a configuration file to determine how to contact the name
   server and decide what algorithm and key it should use.

So if you're looking to secure it, look into details of the key and the key file. For example, /etc/bind/rndc.key (or /etc/named/rndc.key) should have restricted permissions.

share|improve this answer
    
Thanks for the clarification. My netstat output looks similar to yours in that it is listening on 953 but only on the loopback. My only issue now is that when I run nslookup directly on the server, it says "No answer". However, when I run netstat from somewhere else, the results are correct. Any idea why that might be happening? –  smusumeche Dec 20 '10 at 15:18
    
That sounds like a different problem. Make sure /etc/resolv.conf is correct. Probably best to create a new question if that doesn't help. –  Mikel Dec 20 '10 at 23:14

Usually there is no need to forward requests for 953 port on your border firewalls, but it is fruitful to keep it open on DNS server as a local service (of course if you have ssh access to this server). Properly configured rndc is a great tool to manage named.

share|improve this answer

RNDC is the remote administration port. Do not open it to the outside world. Unless you use the rndc utility, it's not necessary for this port to be open at all, you can safely firewall it off.

Bind needs UDP 53 to service normal requests. You should also open TCP 53 if (and only if) this server is the master for a zone and a secondary server needs to transfer from it.

share|improve this answer
    
I'm not sure that's correct. On Debian at least, /etc/init.d/bind9 relies on it. If you disable rndc, you can't start or stop the service. –  Mikel Dec 20 '10 at 5:24
    
Looks like Fedora (and so I assume CentOS) calls /usr/sbin/named to start it, so you might be able to get away without it. Try it and see. That's assuming you don't want to use any of the administration commands (see link below). –  Mikel Dec 20 '10 at 5:52
    
I'd also note that TCP 53 may need to be opened even if you don't have an external secondary requesting zone transfers. If a DNS request is too large to fit into a UDP packet, it will be sent via TCP. Likewise, if a received response is too large, it will be truncated and the requester will resubmit the request via TCP to get the full response. This will happen more as DNSSEC becomes more widespread. –  Justin Scott Dec 20 '10 at 14:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.