| Newsgroups |
gmane.comp.security.incidents |
| Message-ID |
<[email protected]> |
Let me clear up what I stated earlier...
Simply upgrading from a Windows NT based DNS to any BIND
based DNS will not solve your problems...
How I SHOULD have said it:
1. Upgrade to the most current version of BIND 9 (9.3.1)
that is available. (Stable version, not a RC)
http://www.isc.org
2. Restrict other services on the box and harden the O/S.
3. Run named in a chroot environment with a restricted
account.
4. Restrict the DNS functionality through your named.conf
configuration. (i.e. restrict recursive queries, zone
transfers, cache size, implement views, change default CHAOS
version.bind txt record)
5. Check the security of any secondary name servers and any
forwarders.
6. Blackhole offending networks via named.conf. (Be careful
not to get "tricked" into adding innocent networks)
7. Use DNS to reduce banner-ads and/or worm traffic in your
network if desired. (establish master zones and point them
to loopback) http://www.deer-run.com/~hal/sysadmin/dns-
advert.html
8. Implement DNSSEC features if possible. (sign zone
tranfers)
OR
If you have another version of DNS that will provide you
with the security and functionality you need, and you can
validate it is not susceptible to DNS Cache Poisoning via
poorly randomized Query IDs, then use it. There are numerous
other DNS software packages out there (DJBDNS, TinyDNS,
MaraDNS, NSD, PowerDNS, UltraDNS, eNom DNS, Sinple DNS Plus,
etc...)
Sorry for the confusion... ;-)