Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've bind 9.3.6.

How can I disable hostname disclosure ?

Issue link http://www.iss.net/security_center/reference/vuln/bind-hostname-disclosure.htm

Thanks.

share|improve this question
    
The document you link to says There is no remedy as of December 18, 2010 –  Iain Dec 23 '10 at 16:51
    
@Iain even though that message was updated 2 days ago, and remains unchanged, it is still incorrect. –  NOTjust -- user4304 Dec 3 '13 at 18:20

2 Answers 2

up vote 2 down vote accepted

You can hide hostname and version this way:

# /etc/named.conf
options {
    // hide bind info
    hostname "unknown";
    version "unknown";
}

Hostname querying example:

[vitalie@silver ~]$ dig @ns1.kappa.ro hostname.bind chaos txt

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_5.3 <<>> @ns1.kappa.ro hostname.bind chaos txt
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46430
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;hostname.bind.                 CH      TXT

;; ANSWER SECTION:
hostname.bind.          0       CH      TXT     "linux.kappa.ro"

;; AUTHORITY SECTION:
hostname.bind.          0       CH      NS      hostname.bind.

;; Query time: 6 msec
;; SERVER: 194.102.255.3#53(194.102.255.3)
;; WHEN: Wed Jan  5 15:08:14 2011
;; MSG SIZE  rcvd: 72
share|improve this answer
3  
version "unknown" will return the string "unknown". version "none" will actually disable the feature. –  TomOnTime Aug 20 '13 at 14:49

"There is no remedy as of December 18, 2010." Wrong, so very wrong. There has been a fix since February 2006 (at least). Put this in your BIND config (it probably is there already):

options {
  version "none";
}

Let me "craft" this "special" query (don't attempt this at home):

$ nslookup -q=txt -class=CHAOS authors.bind. localhost
Server:         localhost
Address:        127.0.0.1#53

*** Can't find authors.bind.: No answer

For more info on securing BIND have a look at http://www.cymru.com/Documents/secure-bind-template.html

share|improve this answer
1  
To be clear... the string "none" is special in that it disables the feature. This does not happen if you set it to "unknown" or anything else. –  TomOnTime Aug 20 '13 at 14:51
    
Is there a way to disable hostname.bind query as well? –  RustyX Aug 27 at 20:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.