On Tue 05 Apr 2011 at 23:24:47 -0600, Paul E Condon wrote: > On 20110404_190551, Brian wrote: > > I came to the conclusion there was no risk to the server (unbound in my > > case) as long as the server was not answering queries from outside my > > network. Reassurance would be welcome but I'm pretty sure of that. > > > > Part of my testing was done at > > > > https://www.grc.com/dns/dns.htm > > Thanks for this! But there is a lot to read (and hopefully understand) > One specific question: what is mean by 'unbound' in this context?
Unbound is a DNS server; an alternative to BIND. > > First with my ISP's servers in /etc/resolv.conf and then replacing them > > with 127.0.0.1 and forwarding port 53 on the router to the machine > > running unbound. > And again here? Forwarding on the router isn't necessary to test the affect the router has on Source Port Randomness. Check /etc/bind/named.conf to ensure there is no forwarding of DNS requests to another resolver. Edit resolv.conf to use only 'nameserver 127.0.0.1'. Start BIND. http://entropy.dns-oarc.net/test/ is quicker than grc.com to return a test result. You'll likely get a rating of POOR but, assuming queries from the internet are not served, your DNS cache cannot be poisoned because there is no access to it from the outside. -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20110406111404.GU7935@desktop
