Installing A FreeBSD 7.0 DNS Server With BIND

As FreeBSD is known as one of the most stable and reliable operating systems, I decided to publish some useful articles for it, mixing it with services we need on daily bases.

This tutorial shows how to set up a FreeBSD based server that offers DNS services. This tutorial is written for the 64-bit version of FreeBSD, but should apply to the 32-bit version.

FreeBSD-SA-08:06.bind

Topic:      DNS cache poisoning

Category:   contrib
Module:     bind
Announced:  2008-07-13
Credits:    Dan Kaminsky
Affects:    All supported FreeBSD versions.
Corrected:  2008-07-12 10:07:33 UTC (RELENG_6, 6.3-STABLE)
            2008-07-13 18:42:38 UTC (RELENG_6_3, 6.3-RELEASE-p3)
            2008-07-13 18:42:38 UTC (RELENG_7, 7.0-STABLE)
            2008-07-13 18:42:38 UTC (RELENG_7_0, 7.0-RELEASE-p3)
CVE Name:   CVE-2008-1447

For general information regarding FreeBSD Security Advisories, 
including descriptions of the fields above, security branches, 
and the following sections, please visit 
http://security.FreeBSD.org/.

(more...)

Create Your Own Web Server With BIND And Apache On CentOS 5

This tutorial explains how you can run your own web server on CentOS 5 with the help of Apache and the BIND name server.

Setup Private DNS Nameservers for Your Domain with Bind9

You have registered a new domain name, but you dont want to point your nameservers on your hosting provider. Wouldnt it be professional and stylish if you have own dns nameservers ns1.yourdomain.com and ns2.yourdomain.com! You can setup and run your own bind DNS server if you have a VPS or dedicated server with atleast 2 IP Addresses. Most domain registrars compulsarily ask for two nameservers.

I am writing this tutorial keeping it as simple and easy to understand, as DNS concepts are quite difficult to understand and are only limited resources on the Web. One would reckon that DNS is quite regardard as invisible force on the Internet without which everybody would be typing Ip addresses on the internet without names. .It isnt that hard to run your own nameservers and can done with command line on linux!

(more...)

Open Source BIND Alternative Launches

A group of experts on Tuesday released an open source alternative to the BIND DNS server. The new software — dubbed Unbound 1.0 — is a recursive DNS server. From its first prototype in 2004, Unbound was designed to be a faster, more secure replacement for BIND.

(more...)

Hide DNS server (BIND) version from others

DNS server is one of the most targeted application for attack, It’s always a good idea to hide your DNS server version information so that BAD guys cannot view the version and start the attack to this specific version of your DNS server (Bind).

(more...)

Setup a DNS server with bind

After looking on Ubuntu forum for an easy step-by-step howto for instaling a DNS server, I decided the best idea would probably be to write this howto myself.... So, here it is!

BIND 8 EOL: OpenBSD Makes It Easy

SC announced End of Life status for BIND 8 on 27 August, 2007. While most OpenBSD users will not find this news noteworthy, there are undoubtedly many users who may work for organizations that are running BIND 8 in their environment. End of life status for this critical application should result in immediate consideration by those running it to investigate upgrade paths to BIND 9. This should provide an extremely easy opportunity for presenting OpenBSD as a platform to migrate to for hosting new BIND 9 rollouts.

Reduce permissions to increase DNS security

Every server process you run on your system provides another potential point of compromise. That’s why it’s so often recommended that you turn off unnecessary services on Windows machines and deactivate unneeded daemons on UNIX operating systems.

You can’t simply turn off all services and daemons, however, as the ability to use your operating system environment would be severely crippled if you did. As a result, it becomes necessary to attempt to secure the operation of the server processes you need.

When you provide a server system on which multiple clients rely, that can become even more important. Every one of the systems that connects to your server relies on its security — in effect, trusts it, to some extent.

If your server is compromised, it may then become a vector for attacks on clients that connect to it. When you run a server system, you become responsible not only for the security of that system, but at least in part for the security of every computer that connects to it.

An example of such a case is a UNIX or Linux DNS server. Just like any other server software, the BIND server daemon named process may occasionally be subject to security vulnerabilities that may allow a malicious security cracker to gain unauthorized access to your system. It is thus important to configure your system to minimize the damage a security cracker can do when he or she exploits such a vulnerability.

One way to do so with the named process on UNIX and Linux systems is to ensure that it doesn’t run as the root user. If the process runs as a less privileged user account, the damage it can do when compromised by a malicious security cracker is greatly reduced.

(more...)

OpenBSD & BIND 9 cache poisoning

when BIND 9 was first imported into OpenBSD, we decided not to use the default ID generation algorithm (LFSR, Linear Feedback Shift Register) but to use a more proven algorithm (LCG, Linear Congruential Generator) instead. thanks to this wise decision, the BIND 9 shipped with OpenBSD does not have this weakness.

the proactive security of OpenBSD strikes again,

Hide DNS server (BIND) version from others

DNS server is one of the most targeted application for attack, It’s always a good idea to hide your DNS server version information so that BAD guys cannot view the version and start the attack to this specific version of your DNS server (Bind).

(more...)