Loading...
Latest news
COVID19 Le confinement est inutile
700 Films Gatuits
COVID19 Simulation confinement
COVID19 Modified Infected Recovered Model
COVID19 Massive PCR tests a bad idea?
système

Sécurité BIND DNS query denied

Jordi -

Si dans vos logs vous avez des messages du style :

Jun 10 15:08:04 ns293xx named[7778]: client 91.121.103.13#36552: query (cache) ‘vin-de-siecle.pl/MX/IN’ denied
Jun 10 15:08:15 ns293xx named[7778]: client 91.121.103.13#43692: query (cache) ‘vin-de-siecle.pl/MX/IN’ denied
Jun 10 15:08:26 ns293xx named[7778]: client 91.121.103.13#37836: query (cache) ‘vin-de-siecle.pl/MX/IN’ denied
Jun 10 15:08:29 ns293xx named[7778]: client 91.121.103.13#40694: query (cache) ‘vin-de-siecle.pl/MX/IN’ denied
Jun 10 15:08:34 ns293xx named[7778]: client 91.121.103.13#34691: query (cache) ‘vin-de-siecle.pl/A/IN’ denied

Vous devriez vérifier votre configuration de BIND :

BIND (Berkeley Internet Name Domain) est le serveur DNS le plus utilisé sur Internet, spécialement sur les systèmes de type Unix. Il est maintenu par Internet Systems Consortium.

Une nouvelle version de BIND (BIND 9) a été réécrite afin de résoudre certains problèmes architecturaux du code initial et d’ajouter le support de DNSSEC (DNS Security Extensions).

La configuration de Bind par défaut comporte une ”faille” de sécurité, en effet la configuration autorise des tierces personnes à utiliser le serveur DNS (sans demander la permission ^^). Cela fait de notre cher Bind un serveur DNS relais !!

Pour corriger cette faille nous allons ajouter une option dans le fichier “/etc/bind/named.conf.options”.

allow-recursion { 127.0.0.1; serverip;};

Ce qui a pour incidence que l’utilisation de Bind ne sera autorisée que sur le serveur même.

Attention à ne pas mettre “none” autrement votre serveur ne pourra pas résoudre ces propres requêtes !!

allow-recursion { none; };

allow-query-cache

Avec allow-recursion nous avons déjà comblé une partie de la faille, il reste encore à interdire l’utilisation du cache de notre serveur, pour se faire comme d’habitude il faut ajouter une option dans le fichier “/etc/bind/named.conf.options”.

allow-query-cache { 127.0.0.1; serverip;};
16 comments
  1. Ruby Dial

    Hi ,

    I am following up on my message below.

    Who would I speak with about handling your US order fulfillment and shipping?

    Regards,
    Ruby
    order-fulfillment.net

    ————————————————————————

    Hi,

    Who would I speak with at your company that manages your product shipping and order fulfillment?

    We are US company, offering warehousing, order fulfillment and drop shipping to our customers since 2005.

    Here are some of the items we ship for clients:

    -Books, training manuals, guides
    -E-com product drop shipping
    -New member welcomes boxes and gifts
    -Product samples
    -Health and Medical supplements
    -Marketing materials
    -Medical program test kits
    -Follow up gifts to clients, leads, and prospects

    Do you have some time to discuss – phone / email ?

    Thanks,

    Fulfillment Specialist
    http://www.Order-Fulfillment.net

  7. off white

    I enjoy you because of all of your hard work on this site. Betty takes pleasure in setting aside time for internet research and it is simple to grasp why. I learn all of the lively means you give reliable items via the web blog and as well cause contribution from other ones on the issue and our own daughter has been studying a great deal. Have fun with the rest of the new year. Your conducting a stunning job.

  12. lebron james shoes

    My wife and i ended up being quite relieved when Jordan managed to conclude his basic research through the ideas he was given while using the blog. It is now and again perplexing to simply continually be giving away procedures that many the rest could have been selling. Therefore we consider we’ve got the writer to appreciate because of that. The most important illustrations you have made, the straightforward website navigation, the friendships your site aid to foster – it’s got all unbelievable, and it’s really making our son and us recognize that the idea is fun, which is certainly exceedingly fundamental. Thank you for everything!

  13. off white nike

    I truly wanted to construct a small comment in order to thank you for the superb strategies you are giving at this site. My time intensive internet search has now been honored with high-quality suggestions to write about with my neighbours. I ‘d admit that we visitors are unequivocally endowed to live in a really good site with many wonderful professionals with very helpful points. I feel pretty lucky to have come across your site and look forward to plenty of more amazing times reading here. Thanks a lot once more for a lot of things.

  14. kyrie 6

    I’m just commenting to make you be aware of what a impressive discovery my child went through using your blog. She came to understand so many issues, with the inclusion of how it is like to have a marvelous teaching heart to make most people with ease comprehend some multifaceted things. You actually did more than visitors’ expectations. Many thanks for showing the warm and helpful, trustworthy, revealing and unique thoughts on your topic to Sandra.

Laisser un commentaire

Votre adresse e-mail ne sera pas publiée. Les champs obligatoires sont indiqués avec *