Securing against DNS cache poisoning with AD integrated DNS

  • Thread starter Thread starter Guest
  • Start date Start date
Hi,
Me again... :)

The KB article also says you can change this using the GUI.
But what is the protection status if the item is checked in the
GUI, but the registry entry is still not present? Is the server
protected or not?

Cheers,
Geoff.
 
Hi,
Well, fortunately the guys at SANS were able to sort this out for us:
http://isc.sans.org/diary.php?date=2005-04-07
Seems that on Win2000 with SP3 or higher you're safe unless you
are forwarding to an upstrean DNS server that is a windows DNS
server, or a BIND4 or BIND8 server. If the upstream DNS server is
BIND4 or BIND8, use a differnt server that is BIND9. If it is Windows,
ask to make sure it is procected.

If the upstream DNS is not protected and you forward to it, your
windows DNS server will swallow the poisoned records, whether it is
protected or not. Yikes!

Cheers,
Geoff.
 
Well, fortunately the guys at SANS were able to sort this out for us:
http://isc.sans.org/diary.php?date=2005-04-07
Seems that on Win2000 with SP3 or higher you're safe unless you
are forwarding to an upstrean DNS server that is a windows DNS
server, or a BIND4 or BIND8 server. If the upstream DNS server is
BIND4 or BIND8, use a differnt server that is BIND9. If it is Windows,
ask to make sure it is procected.

If the upstream DNS is not protected and you forward to it, your
windows DNS server will swallow the poisoned records, whether it is
protected or not. Yikes!
Click to expand...

The easy workaround is not to forward. Just set up root hints, and then
you'll only query authoritative servers.

BTW, is this what shot down all the Comcast DNS servers yesterday? I'm
using my own root hints setup on BIND9 so I was unaffected but there was
a lot of traffic on the Comcast forums last night from people barely
able to do anything due to downed DNS servers.

Hmm, is the client cache in 2k/XP Workstation subject to this same
cascade failure? That would cause problems if Workstation talked
directly to an ISP BIND8 system.
 
Back
Top