Public SourceMage Discussion List

[Robin Cook <rcook AT wyrms.net>]

How does this effect DNS servers, if at all, that serve two different IP
address for a DNS name depending on where the request came from (ie
private IP addresses and public IP addresses)?

CuZnDragon
Robin Cook

On Fri, 2003-09-19 at 05:51, Seth Woolley wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Please test it.  To prevent DOS attacks on /etc/ I had it move the config
> and the chroot dir over to /var/chroot/bind which has a symlink
> from /etc/bind.  there's a symlink from /etc/bind/etc/bind back to / so
> that chrooting doesn't require a modification to the config (just remove
> the -t /etc/bind from the init script to make it not chroot).
> 
> There's a new config layout, too.  master and slave zones have their own
> directories and config files (mkzones.sh is a tool to create the
> zones.conf and szones.conf files which are included in named.conf), and
> make sure to put your options in options.conf. That allows us to change
> around defaults easily with just an update and makes my scripting easier.
> Hope nobody minds, I like it this way better.
> 
> And it grabs the root zone if it can connect to internic for
> use in with the delegation-only.  It also generates the named.root from
> dig . ns automatically if it can do that.  It automatically backs up your
> config (I hope) and puts it into the new chroot directory as well...  but
> it's still in test for your testing pleasure.  The slave zone it creates
> can be copied to another copy of smgl bind in one easy step to have a
> slave setup.  localhost.rev is auto-generated as well if it doesn't exist.
> 
> All TLDs are set to delegation-only by default, to prevent the dozen or so
> CC and G TLDs from using wildcard results to siphon off typo hits:
> 
> http://isc.org/products/BIND/delegation-only.html
> 
> All future BIND releases will contain the patch from the sound of it.  No
> need to null route their IP anymore or use the hosts file:
> 
> route add 64.94.110.11 reject
> (or I think:, /etc/hosts:64.94.110.11 0.0.0.0)
> 
> zone ".com" { type: delegation-only; };
> 
> $ host lfkjdslfjlsfajsfl.com 4.2.2.1
> lfkjdslfjlsfajsfl.com   A       64.94.110.11
> $ host lfkjdslfjlsfajsfl.com 65.102.47.193
> lfkjdslfjlsfajsfl.com does not exist at ns0.positivism.org, try again
> 
> works like a charm, but to be honest, you need to make a list to be 
> complete:
> 
> # modified from some url I don't remember... original used curl and ipget 
> and printed out the returned IP
> for dom in `wget -O - --passive ftp://ftp.internic.net/domain/root.zone.gz 
> 2> /dev/null | gunzip -c | grep NS | awk '{print $1}' | uniq | egrep 
> "^[^\.]*\.$"`; do
>         host "*.$dom" > /dev/null 2> /dev/null && echo zone '"'$dom'"' '{ 
> type delegation-only; };'
> done
> 
> zone "MUSEUM." { type delegation-only; };
> zone "AC." { type delegation-only; };
> zone "BZ." { type delegation-only; };
> zone "CN." { type delegation-only; };
> zone "COM." { type delegation-only; };
> zone "CX." { type delegation-only; };
> zone "MP." { type delegation-only; };
> zone "NET." { type delegation-only; };
> zone "NU." { type delegation-only; };
> zone "PH." { type delegation-only; };
> zone "PW." { type delegation-only; };
> zone "SH." { type delegation-only; };
> zone "TD." { type delegation-only; };
> zone "TK." { type delegation-only; };
> zone "TM." { type delegation-only; };
> zone "TW." { type delegation-only; };
> zone "WS." { type delegation-only; };
> zone "CC." { type delegation-only; };
> 
> Seth
> - --
> Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
> Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
> Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.2 (FreeBSD)
> 
> iD8DBQE/at/R7fQ833vqzH0RAkWCAKDOiHq+g2zYCJXn62PHfhH1/igP8QCgnetB
> sbYeF3f9s+oZ0r2r0ICp4/0=
> =xzYo
> -----END PGP SIGNATURE-----
> 
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>