Penetration Testing mailing list archives
RE: DNS ACL ?
From: "Giancarlo Paolillo" <gpaolillo () earthlink net>
Date: Fri, 11 Nov 2005 22:12:16 -0500
I think you mean packets over 512 But you should really further lock down your named.conf to allow only certain systems to perform zone transfers. May want to look at TSIG (Transaction Signatures) between DBS name servers. If you can, look at the more recent versions which have additional security features (9.1 and above. 9.3.1 is already out with DNSSEC, etc. -----Original Message----- From: John Hally [mailto:JHally () epnet com] Sent: Friday, November 11, 2005 8:35 AM To: 'pen-test () securityfocus com' Subject: DNS ACL ? Hello All, I need a sanity check regarding DNS ACLs. For external facing DNS servers you need to allow only udp/53 inbound, correct? I know tcp/53 is used for zone transfers and requests/replies greater than a certain size, but they shouldn't typically happen for general dns queries correct? Thanks in advance! ------------------------------------------------------------------------ ------ Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 ------------------------------------------------------------------------ ------- ------------------------------------------------------------------------------ Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------
Current thread:
- DNS ACL ? John Hally (Nov 11)
- Re: DNS ACL ? Stephen J. Smoogen (Nov 13)
- RE: DNS ACL ? Jason Muskat (Nov 13)
- RE: DNS ACL ? Giancarlo Paolillo (Nov 13)
- Re: DNS ACL ? Thor (Hammer of God) (Nov 13)
- Re: DNS ACL ? Richard C Lewis (Nov 13)
- Re: DNS ACL ? Chris Brenton (Nov 13)
- Re: DNS ACL ? Lynx (Nov 13)
- Re: DNS ACL ? Justin Ferguson (Nov 14)
- <Possible follow-ups>
- Re: DNS ACL ? John Nemeth (Nov 13)
- RE: DNS ACL ? Maher Odeh (Nov 13)
- FW: DNS ACL ? Dario Ciccarone (dciccaro) (Nov 21)
- RE: DNS ACL ? Kyle Quest (Nov 22)
- RE: DNS ACL ? Dario Ciccarone (dciccaro) (Nov 24)
(Thread continues...)