|
[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]
|
Re: [PLUG] FYI: Secure BIND Template
|
- From: Jason <jcostom@gmail.com>
- To: "Philadelphia Linux User's Group Discussion List" <plug@lists.phillylinux.org>
- Subject: Re: [PLUG] FYI: Secure BIND Template
- Date: Wed, 12 Dec 2007 08:56:49 -0500
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=/60VkCjM8fqMn9iH88HLAeePe3vlXLCDvVoyvxCxDmM=; b=Eb4uh8H5Ox7xYbwnf4/k1zNC+LZDL4euwDpze5mLaTPOYfJ2JNZts/YA6e2mtKelymhDxDy92JMdT1ogSrNIf7NQ1oollFmoBf7xfpxEPUGWqOGxS+PRgzRH43Yy1t/zz27QSEF9bVv9jxIfdUGJ8PzR9Kt/bNw+WkIHGRNnMZU=
- Reply-to: Philadelphia Linux User's Group Discussion List <plug@lists.phillylinux.org>
- Sender: plug-bounces@lists.phillylinux.org
On 12/11/07, Brian Vagnoni <bvagnoni@v-system.net> wrote:
> Secure BIND Template
>
> http://www.cymru.com/Documents/secure-bind-template.html
>
> Anyone care to comment.
A couple of things I took note of..
1. Zone transfer acl. Early on in the config file, there's an acl for
zone xfers that suggests simply making a list of DNS servers
authorized to perform zone xfers. Further down in the same file, they
attach that acl to the allow-transfer {} statement. This applies the
configuration globally. I'm not fond of that. It would certainly
work for sites that have 2 nameservers and always use the same pri &
secondary servers. However, for those of us with a single server, and
groups of "friends" that exchange secondary dns services, I don't
think it's so hot. Why? Suppose you've got domain[1..5].com, and
you're splitting up secondary dns over 3 different other nameservers.
Now you're granting the ability to zone xfers to the systems that are
NOT secondary for some domains. Better doing allow-transfer {} on a
per-zone basis, IMHO.
2. Logging. I'd guess 99% of the bind servers out there do absolutely
zero logging. They may be a bit over-zealous about their logging, but
more is better than not enough.
3. Chroot. Always sound advice to jail a daemon that interacts with
the outside world. Not a panacea, but defense in depth is usually a
good thing.
4. Views. Wonderful! You'd be shocked how many companies publish
their full internal zones unknowingly.
5. There is no 5.
___________________________________________________________________________
Philadelphia Linux Users Group -- http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug
|
|