How To Patch BIND9 Against DNS Cache Poisoning (Debian/Fedora/CentOS)

for debian based distros:

apt-get update;apt-get upgrade

Almost. You need to enable dnssec as well :-)

Sander, what means 'enable dnssec'? Is there an actual working implementation we can use? Or is that sly geek humor? A number of "tech" reporters have said the same thing, which is why I wonder if it's real :)

@tc: From the article:

Quoting:Afterwards open /etc/bind/named.conf and modify the options section. [...] you should add "dnssec-enable yes;" - this makes that BIND answers queries on random ports which are harder to guess for hackers

Of course, this assumes that someone who runs BIND has modified /etc/bind/named.conf and thus will not simply install the package maintainer's version.

Quoting:Afterwards open /etc/bind/named.conf and modify the options section. [...] you should add "dnssec-enable yes;" - this makes that BIND answers queries on random ports which are harder to guess for hackers

I never specifically enabled dnssec nor mention it anywhere in named.conf, and yet the dns security test sites claim that my name servers "passed" or show "excellent" port randomization...

dnssec (at least in CentOS) is not required to enable random ports.

The only thing that is required is:

yum update

and then to edit /etc/named.conf and verify that you do not have any active rules that include "query-source" (here is an example):

query-source address * port 53;

That rule will make the outbound port be 53 for all queries.

dnssec is a very complicated set up .. though that is recommended ... but JUST enabling one rule in named.conf is not going to cut it :-D

http://www.dnssec.net/

http://www.dnssec-tools.org/wiki/index.php/Authoritative_Ser...