Re: RPZ and negative answers

2013-04-04 Thread Torsten Segner
Am Thu, 4 Apr 2013 23:51:23 GMT schrieb Vernon Schryver : > > From: Chris Buxton > > > A company wants to halt the spread of a piece of malware that > > uses DNS lookups to find its C&C. ... > > > The company has determined the first N domains of the sequence, > > but does not know how to calcu

Re: End-user documentation for full DNSSEC automation using Bind9?

2013-04-04 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, 2013-04-04 at 12:08 -0700, pgbi...@ml1.net wrote: > And/or point to any examples integrating with GKG.net's > API? I have a small python script that parses /etc/named.conf looking for comments indicating zones that are registered with gkg.net,

Re: RPZ and negative answers

2013-04-04 Thread Vernon Schryver
> From: Chris Buxton > A company wants to halt the spread of a piece of malware that > uses DNS lookups to find its C&C. ... > The company has determined the first N domains of the sequence, > but does not know how to calculate the complete set of domains. > ... > Unfortunately, because RPZ doe

Re: RPZ and negative answers

2013-04-04 Thread Chris Buxton
On Apr 4, 2013, at 1:42 AM, Phil Mayers wrote: > On 04/04/2013 12:50 AM, Chris Buxton wrote: > >> Thanks for the explanation. It seems to me this is a gap in coverage >> of RPZ -- the algorithm should be updated, in my opinion, to cover >> the case of a negative answer. > > AIUI it's a deliberate

Re: Auto-dnssec maintain and 'continous' resigning

2013-04-04 Thread Alan Clegg
On Apr 4, 2013, at 12:07 PM, Phil Mayers wrote: > On 04/04/13 16:55, Carlos M. Martinez wrote: >> Thank you very much for all the bits, certainly very helpful. >> >> My problem is that this cycle of zone signing triggers zone number >> increases and generates dozens of NOTIFY messages and the c

Re: Confused about CVE-2013-2266

2013-04-04 Thread Mark Andrews
It says "or upgrade to the patched release most closely related to your current version of BIND" then it lists the two versions to choose from. 9.9.2-P2 is fixed as is 9.9.3b2. Mark In message , Red Cricket writes: > > Hi, > > I am sorry for being so dense but I am confused about what to d

Confused about CVE-2013-2266

2013-04-04 Thread Red Cricket
Hi, I am sorry for being so dense but I am confused about what to do about protecting my BIND DNS servers running 9.9.1-P4 from the regex issue. The link https://kb.isc.org/article/AA-00871 says this ... Impact: ... Intentional exploitation of this condition can cause denial of service in all a

End-user documentation for full DNSSEC automation using Bind9?

2013-04-04 Thread pgbind9
Hi, I run bind 9.9.2. I'm interested in fully automating the DNSSEC key generation/signing/rollover process. A while back, I'd used OpenDNSSEC to attempt it, but was ulitmately foiled by lack of a registrar with an API it could talk to. Since that time, IIUC, bind9's got all the tols integrated

Re: Auto-dnssec maintain and 'continous' resigning

2013-04-04 Thread Phil Mayers
On 04/04/13 16:55, Carlos M. Martinez wrote: Thank you very much for all the bits, certainly very helpful. My problem is that this cycle of zone signing triggers zone number increases and generates dozens of NOTIFY messages and the corresponding zone transfers to all slaves within a short period

Re: Auto-dnssec maintain and 'continous' resigning

2013-04-04 Thread Carlos M. Martinez
Thank you very much for all the bits, certainly very helpful. My problem is that this cycle of zone signing triggers zone number increases and generates dozens of NOTIFY messages and the corresponding zone transfers to all slaves within a short period of time, something which I believe is not very

Re: rate limit dns query response ...

2013-04-04 Thread Vernon Schryver
> From: prakash > We are using bind 9.x on linux and would like to create rate limit for DNS > query from any users ie 10 query per second. Can anyone guide us I would: 1. read http://www.redbarn.org/dns/ratelimits 2. read the new ARM text about RRL by following the link labeled

Re: DLZ $client% parameter segfault

2013-04-04 Thread Vadim S. Goncharov
On 04.04.2013 04:35, Evan Hunt wrote: Thanks certainly blows up the possibility of doing native GeoDNS at the moment? Any chance I am overlooking a method which I could effectively get the clients address into a MySQL query with the current 9.9.2 release? It's not quite the same as %client%, bu

Re: rate limit dns query response ...

2013-04-04 Thread Matus UHLAR - fantomas
On 04.04.13 12:25, prakash wrote: We are using bind 9.x on linux and would like to create rate limit for DNS query from any users ie 10 query per second. Can anyone guide us Note that there are no users in DNS, only clients identified by an IP. These kind of rate limiting can be done at fi

Re: RPZ and negative answers

2013-04-04 Thread Phil Mayers
On 04/04/2013 12:50 AM, Chris Buxton wrote: Thanks for the explanation. It seems to me this is a gap in coverage of RPZ -- the algorithm should be updated, in my opinion, to cover the case of a negative answer. AIUI it's a deliberately limited mechanism aimed at preventing resolution of harmf