DNS Server¶

BIND (bind9, service named) is the DNS server on Linux images. If the README doesn't make the machine a DNS server, sudo apt purge bind9. If it does, an open resolver is the flaw: a DNS server that answers recursive queries for anyone on the internet gets used for amplification attacks, and one that allows zone transfers hands out the whole map of the network.

Where¶

/etc/bind/named.conf.options (global options), /etc/bind/named.conf.local (zones). Check with sudo named-checkconf, reload with sudo systemctl reload named.

The settings¶

In the options { } block:

Setting	Value	Why
`recursion`	`no` for an authoritative server; `yes` only with `allow-recursion` limited to the README's network	Recursion for the world makes an open resolver
`allow-recursion`	`{ localhost; 192.168.1.0/24; };`	Only the organization's clients get recursive answers
`allow-query`	`{ any; };` for public zones, or the network for internal ones
`allow-transfer`	`{ none; };` or the secondary server's address only	Zone transfers (AXFR) list every host in the zone
`allow-update`	`{ none; };`	Nobody rewrites records dynamically
`version`	`"not disclosed";`	`dig version.bind chaos txt` won't reveal the BIND version
`dnssec-validation`	`auto`	Validates signed answers
`listen-on`	the server's address, or `{ 127.0.0.1; 192.168.1.10; };`

options {
        directory "/var/cache/bind";
        recursion no;
        allow-transfer { none; };
        allow-update { none; };
        version "not disclosed";
        dnssec-validation auto;
        listen-on { 127.0.0.1; 192.168.1.10; };
        listen-on-v6 { none; };
};

Zones in named.conf.local can override allow-transfer and allow-update per zone; check each zone { } block for allow-transfer { any; } or allow-update { any; }.

Files¶

/etc/bind is owned by root:bind with mode 2755 on the directory and 644 on the files; zone files under /var/lib/bind or /etc/bind are not world-writable. named runs as the bind user (ps -u bind), never root.

Verify¶

sudo named-checkconf
dig @localhost example.com AXFR            # "Transfer failed."
dig @localhost google.com +norecurse       # no answer section for an authoritative-only server
dig @localhost version.bind chaos txt +short
sudo grep -E 'recursion|allow-transfer|allow-update|version' /etc/bind/named.conf.options /etc/bind/named.conf.local

Example¶

named.conf.options has recursion yes; with no allow-recursion, and the zone in named.conf.local has allow-transfer { any; };. dig @localhost corp.local AXFR dumps 40 records. Set recursion no (the README describes an authoritative server for the company zone), allow-transfer { none; } in both files, add version, named-checkconf, reload, and confirm the AXFR now fails.

Try it¶

Allow zone transfers, run dig AXFR from another VM, then restrict them and run it again.
Turn recursion on and off and test with dig @localhost example.com.

Build it¶

A dns-check.sh: named-checkconf, the three dig tests, and a grep of named.conf.options.

Next¶

auditd