OpenDNS Offers DNS Vulnerability Protection

"Tech site Webmonkey advises users not sure whether or not their DNS servers are patched against a recently discovered vulnerability to switch to the excellent, free DNS service, OpenDNS."

(more...)

FreeBSD-SA-08:06.bind

Topic:      DNS cache poisoning

Category:   contrib
Module:     bind
Announced:  2008-07-13
Credits:    Dan Kaminsky
Affects:    All supported FreeBSD versions.
Corrected:  2008-07-12 10:07:33 UTC (RELENG_6, 6.3-STABLE)
            2008-07-13 18:42:38 UTC (RELENG_6_3, 6.3-RELEASE-p3)
            2008-07-13 18:42:38 UTC (RELENG_7, 7.0-STABLE)
            2008-07-13 18:42:38 UTC (RELENG_7_0, 7.0-RELEASE-p3)
CVE Name:   CVE-2008-1447

For general information regarding FreeBSD Security Advisories, 
including descriptions of the fields above, security branches, 
and the following sections, please visit 
http://security.FreeBSD.org/.

(more...)

Setup Private DNS Nameservers for Your Domain with Bind9

You have registered a new domain name, but you dont want to point your nameservers on your hosting provider. Wouldnt it be professional and stylish if you have own dns nameservers ns1.yourdomain.com and ns2.yourdomain.com! You can setup and run your own bind DNS server if you have a VPS or dedicated server with atleast 2 IP Addresses. Most domain registrars compulsarily ask for two nameservers.

I am writing this tutorial keeping it as simple and easy to understand, as DNS concepts are quite difficult to understand and are only limited resources on the Web. One would reckon that DNS is quite regardard as invisible force on the Internet without which everybody would be typing Ip addresses on the internet without names. .It isnt that hard to run your own nameservers and can done with command line on linux!

(more...)

Open Source BIND Alternative Launches

A group of experts on Tuesday released an open source alternative to the BIND DNS server. The new software — dubbed Unbound 1.0 — is a recursive DNS server. From its first prototype in 2004, Unbound was designed to be a faster, more secure replacement for BIND.

(more...)

Building a Linux IPv6 DNS Server

A tutorial on building a DNS server node that provides IPv6 name resolution, with examples of some useful IPv6 applications.

Running A MyDNS Name Server On OpenBSD

This tutorial shows how to run a MyDNS name server on an OpenBSD server. It covers the installation of MySQL, PHP, MyDNS, and MyDNSConfig, the web frontend for the MyDNS name server.

Hide DNS server (BIND) version from others

DNS server is one of the most targeted application for attack, It’s always a good idea to hide your DNS server version information so that BAD guys cannot view the version and start the attack to this specific version of your DNS server (Bind).

(more...)

Check your DNS records with dig

Have you ever wanted to query the Domain Name System (DNS) to discover what information it holds about your domain? Do you have some important changes to make to your DNS records and need a way to verify your changes? Here's how to check your DNS records with a tool called dig.

Using OpenDNS with your own DNS

"OpenDNS adds the possibility of domain name based filtering. You can configure your own white and blacklist, but they also have a list of categories you can choose from. Most interesting category I found was phising, but I image that if you got small children at home you'd also want to block porn and such. Domain name spelling correction is an added bonus, plus they promise almost 100% service availability, superior performance, domain name spell checking and statistics gathering (can be turned off)."

(more...)

How To Install And Use The djbdns Name Server

djbdns is a very secure suite of DNS tools that consists out of multiple parts: dnscache, a DNS cache that can be used in /etc/resolv.conf instead of your ISP's name servers and that tries to sort out wrong (malicious) DNS answers; axfrdns, a service that runs on the master DNS server and to which the slaves connect for zone transfers; and tinydns, the actual DNS server, a very secure replacement for BIND.

(more...)

Reduce permissions to increase DNS security

Every server process you run on your system provides another potential point of compromise. That’s why it’s so often recommended that you turn off unnecessary services on Windows machines and deactivate unneeded daemons on UNIX operating systems.

You can’t simply turn off all services and daemons, however, as the ability to use your operating system environment would be severely crippled if you did. As a result, it becomes necessary to attempt to secure the operation of the server processes you need.

When you provide a server system on which multiple clients rely, that can become even more important. Every one of the systems that connects to your server relies on its security — in effect, trusts it, to some extent.

If your server is compromised, it may then become a vector for attacks on clients that connect to it. When you run a server system, you become responsible not only for the security of that system, but at least in part for the security of every computer that connects to it.

An example of such a case is a UNIX or Linux DNS server. Just like any other server software, the BIND server daemon named process may occasionally be subject to security vulnerabilities that may allow a malicious security cracker to gain unauthorized access to your system. It is thus important to configure your system to minimize the damage a security cracker can do when he or she exploits such a vulnerability.

One way to do so with the named process on UNIX and Linux systems is to ensure that it doesn’t run as the root user. If the process runs as a less privileged user account, the damage it can do when compromised by a malicious security cracker is greatly reduced.

(more...)

Hide DNS server (BIND) version from others

DNS server is one of the most targeted application for attack, It’s always a good idea to hide your DNS server version information so that BAD guys cannot view the version and start the attack to this specific version of your DNS server (Bind).

(more...)