Very Computer

by **°-?í±** » Wed, 30 May 2001 15:48:34

By default, 'host -l anydomain' query allowed.
Some Site refused this query.
How can I set this?

sorry for bad english ^^

by **Lukasz Wojto** » Wed, 30 May 2001 21:53:46

Quote:> By default, 'host -l anydomain' query allowed.
> Some Site refused this query.
> How can I set this?

i think you should add a regule in your firewall:
ipchains -A input -i eth0 -s 0.0.0.0/0 -d <yourIP> 53 -p TCP -j REJECT
best regards

by **Tad** » Wed, 30 May 2001 22:18:01

In named.conf.....

allow-transfer { none; };

or

allow-transfer { your-secondary-dns-ip; };

From the named.conf man page.....

allow-transfer
Specifies which hosts are allowed to receive zone transfers from
the
server. allow-transfer may also be specified in the zone
statement,
in which case it overrides the options allow-transfer statement.
If
not specified, the default is to allow transfers from all hosts.

Quote:> By default, 'host -l anydomain' query allowed.
> Some Site refused this query.
> How can I set this?

> sorry for bad english ^^

by **Julian T. J. Midgl** » Wed, 30 May 2001 22:16:46

>> By default, 'host -l anydomain' query allowed.
>> Some Site refused this query.
>> How can I set this?

>i think you should add a regule in your firewall:
>ipchains -A input -i eth0 -s 0.0.0.0/0 -d <yourIP> 53 -p TCP -j REJECT

That's really not very helpful at all - that merely adds a line to
your ipchains rules to forbid all TCP based DNS traffic to your
server. This is usually not a particularly sensible thing to do,
since it also prevents your slave servers doing a legitimate zone
transfer. ;-)

You'd be better off preventing unauthorized hosts from making
zone transfers. You do this by specifying an "allow-transfer" line in
the options{} section of your named.conf. E.g.:

options {
allow-transfer { 127/8; 192.168.23/24; 192.168.24/24; };
...

Quote:}

Any hosts not explicitly allowed by the allow-transfer line will have
their zone transfer requests denied.

All the best,

Julian Midgley
--
Julian T. J. Midgley http://www.xenoclast.org
Cambridge, England. PGP Key ID: 0xBCC7863F

Very Computer

refusing query : 'host -l company.com'

refusing query : 'host -l company.com'

refusing query : 'host -l company.com'

refusing query : 'host -l company.com'

refusing query : 'host -l company.com'