RE: [nznog] Verisign grabs *.net and *.com
Quick question - If you don't implement a patch are you leaving yourself exposed to a DOS attack? A simple perl script enumerating random domains and digging at an ISP server could probably fill a DNS cache over a period of time. (It would eventually fall over I guess...) Rob -----Original Message----- From: Nic Bellamy [mailto:nic(a)bellamy.co.nz] Sent: Wednesday, 17 September 2003 10:25 a.m. To: nznog(a)list.waikato.ac.nz On Wed, 2003-09-17 at 09:29, Joe Abley wrote:
On Monday, Sep 15, 2003, at 23:58 Canada/Eastern, Juha Saarinen wrote:
Brent McDowell wrote:
For those of you who use djbdns, a patch has been released that rejects A records that resolve to 64.94.110.11. It'll return NXDOMAIN. http://tinydns.org/djbdns-1.05-ignoreip.patch
Anything for BIND 9?
I am told an official patch is being tested right now.
In the interim, there's a patch floating around for bind9 - haven't found an
official site for it, so I've chucked it up at:
http://www.bellamy.co.nz/stuff/bind9-antiverisign.patch
I can confirm it Works For Me(tm) (even if it's done in a rather ugly
manner).
Cheers,
Nic.
--
Nic Bellamy
"Robert Purdy (DSL AK)"
Quick question - If you don't implement a patch are you leaving yourself exposed to a DOS attack?
A simple perl script enumerating random domains and digging at an ISP server could probably fill a DNS cache over a period of time. (It would eventually fall over I guess...)
With NXDOMAIN caching, that would happen anyway -- the "no such domain" answer is itself cached, so a subsequent query for the same domain can be given a cached answer. Note that you'd have to fill the cache inside the TTL of the cached records -- Verisign's wildcard A records have a TTL of 15 minutes; a cached NXDOMAIN entry gets its TTL from the negative TTL field of the SOA (formerly known as the default TTL). With current versions of BIND 9, you can use the "max-cache-size <bytes>" directive to set the maximum size of the cache, so it starts throwing away un-expired records when the max cache size is approached, thereby avoiding any such DoS. -- don
On Sunday, Sep 21, 2003, at 22:04 Canada/Eastern, Andy Linton wrote:
For info
http://www.iab.org/documents/docs/2003-09-20-dns-wildcards.html
Also, ISC has released a new patch for BIND 9 with a different mechanism for restricting certain zones to be delegation-only. This time, once enabled, the behaviour is enabled for all top-level zones except for nominated exceptions: options { root-delegation-only exclude { "de"; "lv"; "museum"; }; }; See http://www.isc.org/products/BIND/delegation-only.html for more details. Joe
participants (4)
-
Andy Linton -
Don Stokes -
Joe Abley -
Robert Purdy (DSL AK)