Loading ...Restricting zone transfers with IP addresses in BIND DNS Server
DNS server can be attacked using various techniques such as
[a] DNS spoofing
[b] Cache poisoning
[c] Registration hijacking
One of the simplest ways to defend is limit zone transfers between nameservers by defining ACL. I see many admin allows BIND to transfer zones in bulk outside their network or organization. There is no need to do this. Remember you don't have to make an attacker's life easier.
How to restrict zone trasfer with IP address?
You need to define ACL in /etc/named.conf file. Let us say IP 192.168.191.10 and 25.111.24.6 are allowed to transfer your zones.
# vi named.conf
Here is sample entery for domain nixcraft.com (ns1 configuration):
acl trusted-servers {
192.168.191.10; //ns2
25.111.24.6; //ns3
};
zone nixcraft.com {
type master;
file "zones/nixcraft.com";
allow-transfer { trusted-servers; };
};
Next add zone nixcraft.com. Please note that you must use set of hosts later in each zone's configuration block i.e. put line allow-transfer { trusted-servers; }; for each zone / domain name. Restart named:
# /etc/init.d/named restart
How do I test zone transfers restrictions are working or not?
Use any UNIX dns tool command such as nslookup, host or dig. For example, following example uses host command to request zone transfer:
$ host -T axfr nixcraft.com
Output:
;; Connection to 74.86.49.133#53(74.86.49.133) for axfr failed: connection refused.
Transaction signatures (TSIG)
Another recommend option is to use transaction signatures (TSIG) to authorize zone transfers. This makes more difficult to spoof IP addresses. Next time I will write about setting up TSIG.
Want to stay up to date with the latest Linux tips, news and announcements? Subscribe to our free e-mail newsletter or RSS feed to get all updates.
You can Email this page to a friend.
You may also be interested in other helpful articles:
- Check BIND - DNS Server configuration file for errors with named-checkconf tools
- How to: Troubleshoot UNIX / Linux BIND DNS server problems
- Linux Iptables block or open DNS / bind service port 53
- Book review: Pro DNS and BIND
- Executing script or command on the last day of a month
Discussion on This Article:
Leave a Reply
We encourage your comments, and suggestions. But please stay on topic, be polite, and avoid spam. Thank you very much for stopping by our site!
Tags: acl, bind_acl, dns_server, dns_spoofing, hijacking, restrict_zone_transfers, zone_transfers
Hi,
why would you like to restrict your zone transfer? You will allow any resolver to ask for the same data, but you won’t allow a transfer? I suggest you put only public data in your zone file and don’t care about the zone transfer. If you have to have private data in a zone file, set up an internal DNS master (or use split DNS) with a private zone file and restrict access for resolvers and zone transfer.
Ulrich
Yes this information is publicly available through BIND server, there is no reason to make an attacker’s life easier. There is no legitimate reason for anyone outside your organization to transfer your zones in bulk.