Re: AW: Wanted: Gentoo Enterprise Server success stories

On Oct 18, 2011 12:14 PM, "Norman Rieß" <[email protected]> wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 10/17/11 20:06, Pandu Poluan wrote:
> >
> > On Oct 17, 2011 6:44 PM, "Norman Rieß" <[email protected]
> > <mailto:[email protected]>> wrote:
> >>
> >>
> >> Hello,
> >>
> >> sorry to interrupt this thread, but this probably means, you did not
> >> perform any kernel updates on that machine for over two years and
> >> therefore the system is vulnarable to some kernel bugs which where
> >> discovered during this time. On a DNS machine a privilege escalation
bug
> >> is even more severe. I strongly recommend to secure this machine.
> >
> > That depends on what Kai meant with "uptime". Maybe he meant the VMs
> > (he's using Xen, after all) never needs a restart, but the BIND service
> > still gets regular update and the consequent service-restart.
> >
>
> Every Xen VM is running its own kernel and needs to be restarted or
> kexec'ed when this kernel is updated. If this is not the case, the VM is
> vulnerable to kernel bugs just as any other physical system, even if the
> host on which the VM is running is secure.
> I assume BIND is updated and restarted as needed, but that is not enough.

Does it matter if the DNS server is behind a firewall that allows only
TCP+UDP traffic to port 53?

Rgds,