Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have this in /etc/named.conf, I commented the default values and set my own under it. My domain would not load in browser unless I set allow-query to "any", is this OK, what should I edit? If is localhost or 127.0.0.1; 10.0.1.0/24; domain would not load. I tried the 127.. thing because it mentioned it here: http://wiki.mandriva.com/en/Testing:Bind

Bind version is 9.7.0-P2-RedHat-9.7.0-5.P2.el6_0.1 OS is CentOS 6.0.

options {
        // listen-on port 53 { 127.0.0.1; };
        listen-on port 53 { any; };
        //listen-on-v6 port 53 { ::1; };
        listen-on-v6 port 53 { any; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        //allow-query     { localhost; };
        allow-query     { any; };

        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";
};
share|improve this question

1 Answer 1

up vote 3 down vote accepted

When you listen-on 127.0.0.1 or localhost or ::1, and/or allow-query from localhost only, bind will answer only to queries originating from the same computer that runs bind. (It set this way in "testing" probably because they probably just meant to test that bind works without opening it to outside for security reasons.)

It is normal to set those to "any" so that it will be accessible from outside.

share|improve this answer
    
Some online articles mentioned that it might be exposed to DOS attacks if "any". If I understood correctly. –  adrianTNT Nov 12 '11 at 17:49
1  
Well, even if that's true, without "any" it won't work ;) –  Sandman4 Nov 12 '11 at 18:15
    
Btw, what your server purpose is ? Is it only authoritative for some your zone ? Who should be able to access your server ? –  Sandman4 Nov 12 '11 at 18:17
    
It is an image hosting site, it will host multiple domains on same IP. Domain is at godaddy where I set two "hosts" ns1.domain ns2.domain and associated these NS with my server IP. –  adrianTNT Nov 12 '11 at 19:56
    
Ok, so it should be accessible from outside. Thus it must be "any". And you better set "recursion no" if you afraid of attacks. But doesn't godaddy provide nameservers for you ? –  Sandman4 Nov 12 '11 at 20:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.