Re: [Fwd: cvs commit: ports/dns/bind9 Makefile distinfo ports/dns/bind94 Makefile distinfo ports/dns/bind95 Makefile distinfo]

Jeremy Chadwick wrote:

The problem here is WRT network ACLs. The only solution is to bind BIND
to a specific IP address and permit any outbound TCP or UDP traffic +
any inbound TCP or UDP traffic to port 53.

Not quite any inbound traffic, named will pick a source port > 1024. In the current beta versions there is an option to restrict the ports chosen to a range.

I'm also not quite sure what kind of server you're talking about here. If it's authoritative, then by definition you have to allow all inbound traffic to port 53.

Most network administrators
I know of won't like that, as they deny all incoming *and* outgoing
traffic, then apply permit ACLs. There's no "clean" or "strict" permit
ACL, while with port XX, you can at least narrow down things UDP-wise a
bit more.

False economy. The "danger" of allowing inbound UDP traffic is infinitely less than the danger of having a recursive resolver's cache poisoned. The new way of things would be to define those UDP ports that run services other than named on the system, add those to the avoid-* option(s) in named.conf, and block those ports at the firewall, leaving everything else open.

Of course, almost any modern firewall should have keep-state functionality for UDP, so all of this should be moot.

I'll add that the stock src/etc/namedb/named.conf even advocates the use
of query-source ...

It doesn't advocate, it gives an example. This is the reason I am resistant to adding too many examples to our installed named.conf, it is too easy for people to misinterpret them.

Doug

--

This .signature sanitized for your protection
_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Blocking P2P file sharing program
    ... Is that I have to block a specific port at the router? ... In and outbound TCP port 4443 ... Instead of the website you're using, I suggest to use OEx (Outlook Express ... This is a direct link to the Microsoft Public ...
    (microsoft.public.windows.server.networking)
  • Re: Firewall Issues
    ... The last two are your computer trying to access Windows Update which you want to ... It is hard to say for the first one on port 1025. ... go into network connection properties/tcp/ip/advanced/dns and uncheck register this ... > Outbound TCP on http port ...
    (microsoft.public.security)
  • Re: Who is 217.8.241.228,8005
    ... I got to that moments after I posted. ... But why port 8005 on an outbound TCP ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Who is 217.8.241.228,8005
    ... > I got to that moments after I posted. ... But why port 8005 on an outbound TCP ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Firewall Issues
    ... > Inbound TCP on port 1025 ... > Outbound TCP on ttp port ... > Outbound TCP on http port ...
    (microsoft.public.security)