RE: Compromised BIND?

2011-05-31 Thread Frank Bulk - iName.com
Yes, this message arrived in my Inbox 44 minutes after it was sent. Frank -Original Message- From: bind-users-bounces+frnkblk=iname@lists.isc.org [mailto:bind-users-bounces+frnkblk=iname@lists.isc.org] On Behalf Of Warren Kumari Sent: Tuesday, May 31, 2011 4:59 PM To: Warren Kumar

RE: Compromised BIND?

2011-05-31 Thread Frank Bulk
Yes, this message arrived in my Inbox 44 minutes after it was sent. Frank -Original Message- From: bind-users-bounces+frnkblk=iname@lists.isc.org [mailto:bind-users-bounces+frnkblk=iname@lists.isc.org] On Behalf Of Warren Kumari Sent: Tuesday, May 31, 2011 4:59 PM To: Warren Kumar

Re: DNSSEC versus multiple views

2011-05-31 Thread Mark Andrews
In message , John Wobus write s: > What problems do sites have that deploy both multiple views and > DNSSEC? Sign all views. You can decide whether to use the same keying material or use differing keying material. If you use differing keying material you will need to distribute it. Different k

Re: Compromised BIND?

2011-05-31 Thread Warren Kumari
Does anyone else find the bind-users list to be very slow? webster.isc.org (localhost [IPv6:::1]) Tue, 31 May 2011 19:48:30 + -> webster.isc.org (webster.isc.org) Tue, 31 May 2011 20:52:09 + Or is it just me seeing this? W On May 31, 2011, at 4:17 PM, Warren Kumari wrote: > > On M

Re: Compromised BIND?

2011-05-31 Thread Warren Kumari
On May 31, 2011, at 3:22 PM, Kevin Darcy wrote: > On 5/31/2011 2:38 PM, Supersonic wrote: >> I have a BIND 9.8.0-P2 server instance running on a production server. > > Doing what, exactly? Resolving internal names only? Resolving Internet names? > Acting as an authoritative server for internal

Re: Compromised BIND?

2011-05-31 Thread Torinthiel
On 05/31/11 20:38, Supersonic wrote: > I have a BIND 9.8.0-P2 server instance running on a production server. > My firewall is showing repeated attempts by named.exe to connect to IP > addresses in foreign countries on ports , 6667 and 6669 - common IRC > ports used by worms/trojans/zombies. Ch

Re: Compromised BIND?

2011-05-31 Thread Jan-Piet Mens
> I have a BIND 9.8.0-P2 server instance running on a production server. My > firewall is showing repeated attempts by named.exe to connect to IP > addresses in foreign countries on ports , 6667 and 6669 - common IRC > ports used by worms/trojans/zombies. Sounds like you're running an IRC bot.

Re: Compromised BIND?

2011-05-31 Thread Stephane Bortzmeyer
On Tue, May 31, 2011 at 02:38:13PM -0400, Supersonic wrote a message of 38 lines which said: > My firewall is showing repeated attempts by named.exe to connect to > IP addresses in foreign countries on ports , 6667 and 6669 Not enough information to decide. For instance, what was the sour

Re: Compromised BIND?

2011-05-31 Thread Kevin Darcy
On 5/31/2011 2:38 PM, Supersonic wrote: I have a BIND 9.8.0-P2 server instance running on a production server. Doing what, exactly? Resolving internal names only? Resolving Internet names? Acting as an authoritative server for internal clients? Internet clients? Some combination of the above?

Re: Compromised BIND?

2011-05-31 Thread Ray Van Dolson
On Tue, May 31, 2011 at 11:38:13AM -0700, Supersonic wrote: > I have a BIND 9.8.0-P2 server instance running on a production server. My > firewall is showing repeated attempts by named.exe to connect to IP addresses > in foreign countries on ports , 6667 and 6669 - common IRC ports used by > wo

DNSSEC versus multiple views

2011-05-31 Thread John Wobus
What problems do sites have that deploy both multiple views and DNSSEC? I read the "Split-View DNSSEC Operation Practices" draft, which outlines a number of set-ups, generally citing disadvantages in the area of administration, troubleshooting, and added complexity. But it says these set-ups are

Compromised BIND?

2011-05-31 Thread Supersonic
I have a BIND 9.8.0-P2 server instance running on a production server. My firewall is showing repeated attempts by named.exe to connect to IP addresses in foreign countries on ports , 6667 and 6669 - common IRC ports used by worms/trojans/zombies. Checking my named.exe file, it shows that it is

Re: Split DNS Configuration in BIND

2011-05-31 Thread Robert Spangler
On Tuesday 31 May 2011 02:25, the following was written: > > Split DNS is when you have 2 DNS servers, one internal and the other > > external. Internal server serves the clients internally and the External > > services the people on the Internet. This setup is very easy as both > > server ho

Re: Hosting my company DNS server in Internet

2011-05-31 Thread Stephane Bortzmeyer
On Mon, May 30, 2011 at 06:14:25PM +0530, babu dheen wrote a message of 83 lines which said: > please note that i am not going to host my website in DNS server You said the opposite before: > I am not sure why i do need to pay money to my ISP for hosting my > website on my company DNS serve

Re: DNS Racing -Multi ISP load balancing with failover using DNS.

2011-05-31 Thread Phil Mayers
On 31/05/11 09:28, Matus UHLAR - fantomas wrote: This problem could be avoided by providing the same data, but differently sorted, correct? Not really. Client side sorting may take place (e.g. to comply with RFC 3484 policies in calls to getaddrinfo) and destroy any server-side sorting. ___

Re: allowing queries from all IPv4 addresses but only a range of IPv6 addresses

2011-05-31 Thread Dennis Perisa
yep that works. thanks Dave. interestingly, 0/0 also works - thought that might catch IPv6 as well, but a look at the rfc tells me the correct syntax for 'any IPv6 host' is ::/0 On Tue, May 31, 2011 at 8:54 PM, David Forrest wrote: > On Tue, 31 May 2011, Dennis Perisa wrote: > >> Hello community

Re: allowing queries from all IPv4 addresses but only a range of IPv6 addresses

2011-05-31 Thread David Forrest
On Tue, 31 May 2011, Dennis Perisa wrote: Hello community, I have a requirement to configure BIND 9.7.3 to allow queries from any IPv4 address and only a specific IPv6 prefix. The allow-query statement takes an address match list as argument, but I'm not sure how I can specify 'any IPv4 host'

allowing queries from all IPv4 addresses but only a range of IPv6 addresses

2011-05-31 Thread Dennis Perisa
Hello community, I have a requirement to configure BIND 9.7.3 to allow queries from any IPv4 address and only a specific IPv6 prefix. The allow-query statement takes an address match list as argument, but I'm not sure how I can specify 'any IPv4 host' without having to use the 'any' keyword (whic

Re: Split DNS Configuration in BIND

2011-05-31 Thread babu dheen
Robert you are great. You got it when i required. Thanks for sharing the informatino. Will go through it and update all.   Keep it up.   Regards Babu --- On Tue, 31/5/11, Robert Spangler wrote: From: Robert Spangler Subject: Re: Split DNS Configuration in BIND To: bind-users@lists.isc.org Dat

Re: DNS Racing -Multi ISP load balancing with failover using DNS.

2011-05-31 Thread Matus UHLAR - fantomas
> In message <4de43e3e.2040...@chrysler.com>, Kevin Darcy writes: > > Normally I'd defer to your vastly greater knowledge and experience in > > DNSSEC, but here in the U.S. we have a saying "I'm from Missouri", which > > is a roundabout way of expressing "show me" ("Show Me" being the > > unoffi

Re: recursive lookups problems with 9.8.0_p2

2011-05-31 Thread Matus UHLAR - fantomas
> > Would it be convenient to try 9.8.1b1? It has a fix that may address > > this problem. On 30.05.11 18:31, Evan Hunt wrote: > I should add that I don't recommend using 9.8.1b1 in a production > environemnt because of a known security flaw. But it might be > informative to test with it and see