Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

cat /etc/named.conf

[...]
acl "trusted" {
IPS HERE
};

options {
allow-recursion { trusted; };
allow-notify { trusted; };
allow-transfer { trusted; };
allow-query { trusted; };
directory "/var/named";
dump-file "/var/named/named_cache_dump.db";
statistics-file "/var/named/named_stats.log";
empty-zones-enable no;
};
[...]

I saw the following and was wondering what IPs do I need to whitelist? Am I adding the root-nameservers?

I want to know how to protect myself from DNS attacks like illegal transfers/recursion/poisoning.

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

You really need two ACLs to handle that properly. One for peer name servers, and one for clients.

acl "nameservers" {
    # A list of all the name servers that this server has transfers or receices zones from
    # should basically be all the masters/slave name servers, for all defines zones
};

acl "internalclients" {
    # all your internal networks/client machines that can use this name server for resolution.
    127.0.0.0/8;
    10.0.0.0/8;
    172.16.0.0/12;
    192.168.0.0/16;
};

options {
    allow-notify { nameservers; };
    allow-transfer { nameservers; };
    allow-recursion { internalclients; };
    allow-query { internalclients; };
};

zone "example.org" {
    allow-query {any;};
    allow-transfer { nameservers; };
};

For the best level of poisoning protection you really shouldn't be serving zones from the same DNS servers that you are using for client resolution though. But if you trust your internal clients, then I believe a setup like this is adequate.

share|improve this answer
    
So ACL nameservers is the IPs of my nameservers? -- if dns is hosted on same server as clients, it possible they could hijack transfers? –  Tiffany Walker Feb 7 '13 at 20:49
    
Yes, the nameservers acl is a list of all your name servers. I don't think they your clients could hijack a transfer, but I am not 100% certain. –  Zoredache Feb 7 '13 at 21:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.