secondary DNS probem ( thanks steven)

[Stephen Carville]

sylvan dacounha wrote:
> thnaks stevan..
>   really apprecite your quick reply..
>   u advise was a grt help for me
>    
>   i was makin a silly mistake
>    
>   jus for your information i paste a part of named.conf file where i was
> makin the mistake
>    
>   acl allow-list {10.0.0.0/8;
>                 172.16.0.0/16;
>                 62.150.152.0/24;
>                 195.226.224.72;
>                 195.226.224.74;
>                 127.0.0.1;
>                 };
> options {
>         directory "/var/newnamed";
>         //allow-query { allow-list; };
>         allow-notify { 62.150.152.2 ; };
>         allow-recursion { allow-list; };
>         recursion no;
>    
>   i had recursion no --statement after my acl allow list ..
>   i jus removed it and it worked perfect...
>    
>   btw i jus wanna know is my server open to dos attacks since i already
> have my acl list ..
>   so definately my server is safe ... am i right

Go to a machine not on a net in your acl and try

$ dig @62.150.152.1  www.qwertyasdfgh.net

you should get back a list of root servers for .net.

Preventing recursion does not protect your from all DOS attacks against 
DNS but it does stop some of the most obvious ones.  The law of 
dimishing returns applies to security too.  Fortunately 99% of the 
a**holes out there are looking for easy targets so even a few small 
measures will prompt them to look elsewhere.

>   once again really appreciate for ur professional help
>    
>    
>   regards 
>    
>   simon
>    
>   cheers
>   :)
>    
>    
>   
> 
> Stephen Carville <stephen at totalflood.com> wrote:
>   sylvan dacounha wrote:
>> Dear All,
>>
>> I have a REDHAT box running bind and been working fine for last few
>> months. 
>> this server was hosting my other other local domains also which were all
>> workin fine
>>
>> i installed a new redhat machine with bind to be a secondary or slave
>> named server a week ago as per the documentation .
>> so if my primary server goes down all my clients and the inrternet
>> users can still access my my web sites.
>>
>> Now when i restart my primary i c the zones gettin transferred to my
>> secondary DNS which i newly setup and when i do a nslookup goin into the
>> server for internet sites ex: www.yahoo.com it does not resolve them
>>
>> but the sites hosted in my netwrok im able to resolve them fine
>>
>> here the details
>>
>> my master name server .. ns1.kmun.gov.kw ---- IP
>> 62.150.152.1
>> slave server which new installed .. ns2.kmun.gov.kw ------- IP
>> 62.150.152.2
> 
> Looks like 62.150.152.2 is set with recursion off. That means it will 
> only answer for zones it is authoritative for. If you want it to be a 
> server for others to query, set recursion to yes. You are using Bind 9 
> (v9.3.4) so you can set an access list for allow-recursion.
> 
> Something like:
> 
> acl allowed-nets { x.x.x.0/24; y.y.200.0/21; };
> 
> options {
> recursion yes;
> allow-recursion { allowed-nets; };
> };
> 
> The allow-recursion is optional but without it, sooner or later, some 
> dickhead script kiddie will try a DOS on you.
> 
>> if i go to server ns1.kmun.gov.kw or the ip i can resolve both the
>> internet sites as well as my local domain ...
>>
>> appreciate ur help
>>
>> thnks and Regards
>>
>>
>>
>> simon
>>
>>
>>
>>
>>
>>
>>
>> ---------------------------------
>> Pinpoint customers who are looking for what you sell. 
> 
> 


-- 
Stephen Carville <stephen at totalflood.com>
Systems Engineer
Land America
1.626.667.1450 X326