Closing open DNS

[mjk]

I have noticed that the default setup for bind under VHCS allows it to be used as an open dns.

I have only just discovered how bad this is (think open smtp relay). So it would be good if ispCP worked to prevent open dns.

[joximu]

is it also in ispcp?

[BioALIEN]

As joximu said, can you please confirm this is also the case with ispCP?

[mjk]

I have not installed ispCP yet as I am waiting on the stable release to install it and upgrade my vhcs installs.

dnsreport.com will report it. Perhaps someone that does ispCP installed could run the report?

[joximu]

open dns means: you can ask this server about domain names which he isn't responsible for.

This seems to be enabled in ispcp.

But should be only a little option in bind9

/Joximu

[ephigenie]

yeah this can be done via acl's

[raphael]

A simple

recursion no;

in the options {} section of the bind config file will do the trick

[ephigenie]

yeah but thats not a good idea - because then your local server is not able to answer queries to the server itself. (beyond the authoriative zones) But thats often a must because isp's dns server are sometimes quiet unreliable.

I'd recommend putting this into your named.conf.options

Code:

acl local {
        127.0.0.1;
        <your-ip>;
        };

allow-recursion { local; };

and use the isp/ providers dns as forwarders if needed.

[raphael]

I'm wondering what would happen if a server makes use of opendns...

[ephigenie]

yeah, i too - but that question can be left to the people at dnsreport.com - i cannot find something bad on that at all.