[prev in list] [next in list] [prev in thread] [next in thread]
List: isn
Subject: [ISN] How to protect your DNS servers from hackers
From: InfoSec News <alerts () infosecnews ! org>
Date: 2007-01-29 7:18:11
Message-ID: Pine.LNX.4.61.0701290118020.20782 () conundrum ! infosecnews ! org
[Download RAW message or body]
http://www.techworld.com/networking/features/index.cfm?featureid=3129
By Ron Nutter
Network World
January 29, 2007
Our network is protected by a firewall but my predecessor put both the
primary and secondary DNS servers that resolve our domains to the
outside world outside of the firewall protecting our network. What is
the best way to protect our DNS servers from unwelcome visitors?-- Via
the Internet.
There are several things that you can do to prevent problems. I would
recommend putting the DNS servers behind your current firewall and give
them a public IP address. When allowing port 53 through the firewall, be
sure to allow both TCP and UDP through. I learned this one the hard way
the first time I put DNS servers behind a firewall. There were
intermittent problems in DNS resolution until both TCP and UDP were
allowed through the firewall for port 53.
If you put the DNS servers behind your current firewall, I would suggest
putting the servers in a different subnet from your server farm or
anything else on your network. I would also suggest putting an access
control list statement in the switch for the subnet that the DNS servers
will be on that doesnt allow traffic from the DNS servers to ingress
onto your network and only talk over your Internet connection. Another
option is to put the servers on a DMZ connection. Some firewalls allow
this with the installation of an additional network card if the firewall
you have doesnt have an additional port already available.
Another option is to place the DNS servers behind a seperate firewall
that isn't connected to your network. In this way, if the firewall and
or one of the DNS servers is compromised, your network won't be in any
danger since there isn't a direct connection. If you are open to setting
up a third DNS server (assuming that you only have two at this point),
you can implement yet another protection option. In this type of
configuration, both of the forward facing DNS servers are secondary DNS
systems. Since the DNS information on this server can't be directly
changed, the unauthorized change would only last until the next time the
secondary server receives an update from the new master that you have
setup. For this to succeed, the master DNS server would not have a
public IP address and would be configured to only talk to the secondary
DNS servers.
The DNS software you're using might allow additional options. For
example, Bind 9 can implement a feature called a view that can prevent a
DNS server from giving out DNS resolution on domains that the server
isn't directly configured to provide information for. This means that
the server wont be a public DNS server source that anyone could use.
Extra traffic can be "discouraged" from using your DNS servers for
domains they aren't serving.
_____________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic