Inner Mongolia Power dns domain transfer vulnerability and Solution

Source: Internet
Author: User
Tags domain transfer

Inner Mongolia Power dns domain transfer vulnerability and Solution

Dns region transfer Vulnerability

Dns is the foundation of the entire internet company's business. At present, more and more Internet companies are building their own DNS servers for resolution services. At the same time, because DNS is a basic service, therefore, many companies will configure the Primary and Secondary DNS servers, and data synchronization between the primary and secondary DNS servers will use dns domain transfer. However, if the configuration is inappropriate, as a result, any anonymous user can obtain all records of a domain on the DNS server and expose the basic business and network architecture of the entire enterprise to external entities, resulting in serious information leakage, it may even cause enterprise network penetration.

> ls -d []                   SOA (20090225 300 60 1209600 43200)                   MX     10                   MX     10                   NS                95598                          A www.bmdy                       A               MX     10                 MX     10 www.dkyy                       A dns                            A www.ehv                        A www.erdos                      A www.hlbe                       A impcppm                        A imptc                          A localhost                      A mailgate                       A mx                             A news                           A nmdl2                          A nmsg                           A oaserver                       A oavpn                          A sg                             A vpn                            A www.whdy                       A wlxy                           A wlxy                           A www                            A wzglb                          A xady                           A www.xjwgdj                     A www.xmdy                       A xt                             A xtapp                          CNAME yb                             A yxwx                           A zhaopin                        A                   SOA (20090225 300 60 1209600 43200)




Solution: Region transfer is a common DNS function, and the vulnerability of region transfer cannot be solved. You can strictly limit the hosts that allow region transfer, for example, a primary DNS server should only allow it to perform the regional transfer function from the DNS server.

For bind software, you can use the allowe-transfer command to control it. It can be used as a parameter of the global option or zone option. The address list is as follows:

allowe-transfer {;;};

However, the address-Based Access Control List may be bypassed by some "determined" hackers. The best way is to use the TSIG key to strictly define the region transfer relationship, as shown below:

allowe-transfer {key "dns1-slave1"; key "dns1-slave2";};

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.