[ISN] How to protect your DNS servers from hackers

From: InfoSec News (alerts@private)
Date: Sun Jan 28 2007 - 23:18:11 PST


By Ron Nutter
Network World
January 29, 2007

Our network is protected by a firewall but my predecessor put both the 
primary and secondary DNS servers that resolve our domains to the 
outside world outside of the firewall protecting our network. What is 
the best way to protect our DNS servers from unwelcome visitors?-- Via 
the Internet.

There are several things that you can do to prevent problems. I would 
recommend putting the DNS servers behind your current firewall and give 
them a public IP address. When allowing port 53 through the firewall, be 
sure to allow both TCP and UDP through. I learned this one the hard way 
the first time I put DNS servers behind a firewall. There were 
intermittent problems in DNS resolution until both TCP and UDP were 
allowed through the firewall for port 53.

If you put the DNS servers behind your current firewall, I would suggest 
putting the servers in a different subnet from your server farm or 
anything else on your network. I would also suggest putting an access 
control list statement in the switch for the subnet that the DNS servers 
will be on that doesnt allow traffic from the DNS servers to ingress 
onto your network and only talk over your Internet connection. Another 
option is to put the servers on a DMZ connection. Some firewalls allow 
this with the installation of an additional network card if the firewall 
you have doesnt have an additional port already available.

Another option is to place the DNS servers behind a seperate firewall 
that isn't connected to your network. In this way, if the firewall and 
or one of the DNS servers is compromised, your network won't be in any 
danger since there isn't a direct connection. If you are open to setting 
up a third DNS server (assuming that you only have two at this point), 
you can implement yet another protection option. In this type of 
configuration, both of the forward facing DNS servers are secondary DNS 
systems. Since the DNS information on this server can't be directly 
changed, the unauthorized change would only last until the next time the 
secondary server receives an update from the new master that you have 
setup. For this to succeed, the master DNS server would not have a 
public IP address and would be configured to only talk to the secondary 
DNS servers.

The DNS software you're using might allow additional options. For 
example, Bind 9 can implement a feature called a view that can prevent a 
DNS server from giving out DNS resolution on domains that the server 
isn't directly configured to provide information for. This means that 
the server wont be a public DNS server source that anyone could use. 
Extra traffic can be "discouraged" from using your DNS servers for 
domains they aren't serving.

Subscribe to InfoSec News

This archive was generated by hypermail 2.1.3 : Sun Jan 28 2007 - 23:27:53 PST