Loading...
système

Sécurité BIND DNS query denied

Si dans vos logs vous avez des messages du style :

Jun 10 15:08:04 ns293xx named[7778]: client 91.121.103.13#36552: query (cache) ‘vin-de-siecle.pl/MX/IN’ denied
Jun 10 15:08:15 ns293xx named[7778]: client 91.121.103.13#43692: query (cache) ‘vin-de-siecle.pl/MX/IN’ denied
Jun 10 15:08:26 ns293xx named[7778]: client 91.121.103.13#37836: query (cache) ‘vin-de-siecle.pl/MX/IN’ denied
Jun 10 15:08:29 ns293xx named[7778]: client 91.121.103.13#40694: query (cache) ‘vin-de-siecle.pl/MX/IN’ denied
Jun 10 15:08:34 ns293xx named[7778]: client 91.121.103.13#34691: query (cache) ‘vin-de-siecle.pl/A/IN’ denied

Vous devriez vérifier votre configuration de BIND :

BIND (Berkeley Internet Name Domain) est le serveur DNS le plus utilisé sur Internet, spécialement sur les systèmes de type Unix. Il est maintenu par Internet Systems Consortium.

Une nouvelle version de BIND (BIND 9) a été réécrite afin de résoudre certains problèmes architecturaux du code initial et d’ajouter le support de DNSSEC (DNS Security Extensions).

La configuration de Bind par défaut comporte une ”faille” de sécurité, en effet la configuration autorise des tierces personnes à utiliser le serveur DNS (sans demander la permission ^^). Cela fait de notre cher Bind un serveur DNS relais !!

Pour corriger cette faille nous allons ajouter une option dans le fichier “/etc/bind/named.conf.options”.

allow-recursion { 127.0.0.1; serverip;};

Ce qui a pour incidence que l’utilisation de Bind ne sera autorisée que sur le serveur même.

Attention à ne pas mettre “none” autrement votre serveur ne pourra pas résoudre ces propres requêtes !!

allow-recursion { none; };

allow-query-cache

Avec allow-recursion nous avons déjà comblé une partie de la faille, il reste encore à interdire l’utilisation du cache de notre serveur, pour se faire comme d’habitude il faut ajouter une option dans le fichier “/etc/bind/named.conf.options”.

allow-query-cache { 127.0.0.1; serverip;};
135 comments
  1. longchamp

    I just wanted to write down a small message so as to thank you for those splendid strategies you are sharing on this site. My particularly long internet investigation has at the end of the day been compensated with brilliant facts and strategies to talk about with my close friends. I would assume that many of us visitors are unquestionably lucky to be in a great network with very many marvellous people with useful techniques. I feel somewhat grateful to have encountered your webpage and look forward to tons of more pleasurable moments reading here. Thanks once more for all the details.

  2. off white

    Needed to write you this very little note to be able to give thanks over again for those fantastic ideas you have documented above. It is certainly surprisingly open-handed of you to give publicly just what a few individuals could possibly have distributed as an electronic book in making some money for their own end, precisely seeing that you might well have done it if you desired. The tricks in addition served as the great way to fully grasp that some people have similar desire the same as my own to know more and more with regards to this problem. I’m certain there are millions of more fun opportunities up front for folks who look over your site.

  3. giannis antetokounmpo shoes

    I simply wanted to say thanks yet again. I am not sure what I would’ve followed in the absence of the opinions revealed by you over such a area. This has been a real scary issue in my opinion, however , encountering the very skilled technique you handled that took me to jump over happiness. Extremely happy for your advice and then wish you recognize what an amazing job you’re providing training many others via a web site. Most likely you’ve never come across all of us.

  4. yeezy

    I would like to express my gratitude for your kindness giving support to people that need help on in this subject matter. Your very own commitment to passing the solution throughout had been astonishingly beneficial and has in most cases allowed ladies much like me to attain their objectives. This helpful publication implies this much a person like me and somewhat more to my peers. Thank you; from everyone of us.

  5. supreme clothing

    I must show some appreciation to the writer for rescuing me from this particular dilemma. Right after browsing throughout the the net and coming across opinions which are not powerful, I figured my life was well over. Existing minus the strategies to the issues you have sorted out by means of your main short article is a crucial case, as well as those which may have in a negative way damaged my entire career if I hadn’t discovered your website. Your personal understanding and kindness in playing with all things was excellent. I’m not sure what I would have done if I hadn’t come across such a solution like this. I am able to now relish my future. Thanks for your time so much for your specialized and amazing guide. I will not hesitate to endorse the blog to anybody who should have guide about this matter.

  6. bape hoodie

    I happen to be commenting to make you know what a great discovery my child undergone browsing yuor web blog. She learned a wide variety of things, most notably what it is like to have a marvelous coaching heart to make many people really easily know specified problematic subject areas. You actually surpassed readers’ expected results. Thank you for supplying such interesting, dependable, edifying and also fun guidance on that topic to Jane.

  7. pg shoes

    I must convey my admiration for your generosity giving support to those people that should have assistance with this important idea. Your special commitment to getting the solution along became definitely functional and has in most cases made regular people just like me to reach their dreams. Your entire insightful tips and hints signifies much a person like me and additionally to my mates. Best wishes; from each one of us.

  8. goyard handbags & purses

    I really wanted to compose a small message to be able to thank you for these precious points you are giving out at this site. My incredibly long internet research has at the end of the day been rewarded with extremely good facts and techniques to talk about with my family and friends. I would claim that many of us readers actually are truly blessed to live in a very good network with so many special professionals with good ideas. I feel really happy to have discovered your entire webpages and look forward to many more fun times reading here. Thanks once more for a lot of things.

Laisser un commentaire

Votre adresse e-mail ne sera pas publiée.