2

I've bind 9.3.6.

How can I disable hostname disclosure ?

Issue link http://www.iss.net/security_center/reference/vuln/bind-hostname-disclosure.htm

Thanks.

  • The document you link to says There is no remedy as of December 18, 2010 – Iain Dec 23 '10 at 16:51
  • @Iain even though that message was updated 2 days ago, and remains unchanged, it is still incorrect. – NOTjust -- user4304 Dec 3 '13 at 18:20
5

You can hide hostname and version this way:

# /etc/named.conf
options {
    // hide bind info
    hostname "unknown";
    version "unknown";
}

Hostname querying example:

[vitalie@silver ~]$ dig @ns1.kappa.ro hostname.bind chaos txt

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_5.3 <<>> @ns1.kappa.ro hostname.bind chaos txt
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46430
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;hostname.bind.                 CH      TXT

;; ANSWER SECTION:
hostname.bind.          0       CH      TXT     "linux.kappa.ro"

;; AUTHORITY SECTION:
hostname.bind.          0       CH      NS      hostname.bind.

;; Query time: 6 msec
;; SERVER: 194.102.255.3#53(194.102.255.3)
;; WHEN: Wed Jan  5 15:08:14 2011
;; MSG SIZE  rcvd: 72
  • 4
    version "unknown" will return the string "unknown". version "none" will actually disable the feature. – TomOnTime Aug 20 '13 at 14:49
  • In ubuntu 12/14 and debian 8 config file is in : /etc/bind/named.conf.options – fermin Nov 15 '16 at 7:15
6

"There is no remedy as of December 18, 2010." Wrong, so very wrong. There has been a fix since February 2006 (at least). Put this in your BIND config (it probably is there already):

options {
  version "none";
}

Let me "craft" this "special" query (don't attempt this at home):

$ nslookup -q=txt -class=CHAOS authors.bind. localhost
Server:         localhost
Address:        127.0.0.1#53

*** Can't find authors.bind.: No answer

For more info on securing BIND have a look at http://www.cymru.com/Documents/secure-bind-template.html

  • 2
    To be clear... the string "none" is special in that it disables the feature. This does not happen if you set it to "unknown" or anything else. – TomOnTime Aug 20 '13 at 14:51
  • Is there a way to disable hostname.bind query as well? – rustyx Aug 27 '14 at 20:07
2

You can disable hostname.bind by putting this in named.conf (valid in BIND 9.9 that I use):

options {  
  hostname none;  
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.