Re: Qs Regarding DNS

["John R. Morris" <jrmorris () nerdality com>]

uus36 () hotpop com wrote:

> Hi,
>
> I wanna know all the address of a site for eg lets say
> windowsupdate.microsoft.com
>
> Now when i do nslookup dig or host i find 7-8 entries but that does not
> assure me that these are ALL the sites.
>
> What i wanna do is get all the ip's of a site n block them.
>
> but via this method i am not sure that i have all the ips of site.
> i checked few websites on which it gives me a subnet about that site 
> but not specifically n ... i think those are specific to a region.
>
> Well ne one has some suggestion .. know some tool?
>
> Thanx in Advance
>
> -Joe
>  
Well, since most DNS servers that service regular "anybody" Internet 
lookups for a domain are configured to not allow zone transfers, there 
is not an easy way to see all the records of a domain that I'm aware of. 
In fact disallowing zone transfers is done to prevent some hacker from 
finding out all your hosts without brute force (i.e., use your domain 
name to get NS, MX, etc and use those IPS to generate a range to do 
lookups on, collate results to form a picture of things).

Also, take into consideration the concept of views in DNS config in BIND 
(and other DNS servers as well have their own such things), with that I 
can specify multiple zone files for the same domain for different views, 
and among other criteria, sort who sees what view based on the query's 
originating IP (match-clients). Even by itself you could easily confuse 
or befuddle someone wishing to get a complete list to block your site 
(assuming you have multiple IPs to hand out for a given A record you 
didn't want easily blocked). And when you factor in using things like 
this plus all the packet mangling of iptables/netfilter, other network 
load balancing, virtual interfaces and so on, the fun can go on and on. 
Not to mention that you could *also* do things like have some of your 
views setup to lie. Or some of your A records bogus if you don't want to 
use views.

For example. Let's say I run a bad website. Evil. Truely. And I know 
folks are going to try and block access in a attempt to censor my vile 
evilness. I could throw in a good website's (like I don't know, Google 
or something) ips so that when you query www.blockme.net 1/12 of the 
time using views and so on you get one of google's ips. Now folks who 
want my evilness may be a bit put off or confused when they get google 
instead, but will probably just hit refresh or try again later. If a 
blocker gets the bait, and then puts google in their ACL, though... They 
aren't going to like that much. And if I had any more of an idea who is 
doing the blocking (like say they automated lookups to run every day 
against my domain to add me to their blacklist) I could analyze that and 
make sure they got bogus ips every time while legitimate users got the 
right ones. Imagine a blacklisting service to prevent Evilness(TM) that 
collects (say from google) a list of sites that are ranked high in evil 
content based on keywords, and then goes and dutifully collects the 
corresponding IPs. This will be a noticeable recurring logged event from 
my DNS server. Probably at roughly the same recurring time. Fortunately 
for the known universe, the bad guys are 99.999% stupid and lazy (the 
ones who aren't both usually succeed and retire to some island to enjoy 
their success, or grow up, or become stupid and/or lazy).

But the short and sweet way to block access to a domain name is to use 
DNS against itself.
For a single host:
Under linux/unix & MacOS X:
edit /etc/hosts
add a:
127.0.0.1   www.blocked.net
line to it.

Under windows:
edit HOSTS in:
*Windows XP*    =       *C:\WINDOWS\SYSTEM32\DRIVERS\ETC*
*Windows 2K*    =       *C:\WINNT\SYSTEM32\DRIVERS\ETC*
*Win 98\ME*     =       *C:\WINDOWS*


Similiar syntax. Here's a webpage for reference:
http://www.mvps.org/winhelp2002/hosts.htm

For a whole network of hosts:
Build a caching (or multiple if you have a big network) DNS server, 
create a bogus zone for each domain you want to block, feed it to your 
local DNS clients (make sure they use your caching NS as a resolver).

Sure, someone can still use an IP to get whatever they wanted, or a 
program could use a hardcoded IP address. But if that was the case, most 
likely you'd only have one or two IP address that you could easily add 
to acl and block after monitoring traffic and discovering it per your 
favorite network traffic monitoring technique.

FWIW - HTH,
John