Importance of Public DNS Servers

The purpose of a DNS server is to enable people and applications to lookup records in DNS tables. Most DNS servers are now private, meaning that they are configured to only provide service to the people and organizations who own and maintain them.

A few domain name servers on the Internet provide DNS resolutions for anyone who requests it of them. These are known as "Public DNS Servers."

Most public DNS servers are public on purpose. A few public DNS servers are public only because they have been misconfigured by their system administrators. Those DNS servers tend to eventually be fixed.

Public DNS Servers

Level 3 Communications (Broomfield, CO, US)
4.2.2.1
4.2.2.2
4.2.2.3
4.2.2.4
4.2.2.5
4.2.2.6
Verizon (Reston, VA, US)
151.197.0.38
151.197.0.39
151.202.0.84
151.202.0.85
151.202.0.85
151.203.0.84
151.203.0.85
199.45.32.37
199.45.32.38
199.45.32.40
199.45.32.43
GTE (Irving, TX, US)
192.76.85.133
206.124.64.1
One Connect IP (Albuquerque, NM, US)
67.138.54.100
OpenDNS (San Francisco, CA, US)
208.67.222.222
208.67.220.220
Exetel (Sydney, AU)
220.233.167.31
VRx Network Services (New York, NY, US)
199.166.31.3
SpeakEasy (Seattle, WA, US)
66.93.87.2
216.231.41.2
216.254.95.2
64.81.45.2
64.81.111.2
64.81.127.2
64.81.79.2
64.81.159.2
66.92.64.2
66.92.224.2
66.92.159.2
64.81.79.2
64.81.159.2
64.81.127.2
64.81.45.2
216.27.175.2
66.92.159.2
66.93.87.2
Sprintlink (Overland Park, KS, US)
199.2.252.10
204.97.212.10
204.117.214.10
Cisco (San Jose, CA, US)
64.102.255.44
128.107.241.185

Source: tech-faq.com

How to Secure Network from Kaminsky's DNS Cache Poisoning Flaw

The seriousness of the recent DNS cache poisoning vulnerability, discovered by security researcher Dan Kaminsky, raises the bar for network security administrators and should provoke development of a comprehensive plan to address this insidious threat. Every enterprise has a caching DNS server and is thus a target of the Kaminsky DNS cache poisoning flaw.

A Kaminsky DNS cache poisoning attack consists of two steps:

Step No. 1: The attacker sends fake DNS queries, or questions, to internal caching DNS servers. These queries are for domains that the caching server will not have cached, so it will have to generate subsequent queries to authoritative servers on the Internet.

Step No. 2: The attacker then sends a barrage of fake answers to each fake question, attempting to spoof the answer from the authoritative server. To succeed, the attacker has to correctly guess various query parameters—such as Transaction ID and User Datagram Protocol (UDP) source port—before a valid response from the legitimate authoritative server reaches the caching DNS server. There are some additional technical details about the fake answer that will be discussed later in this article.

If the attacker succeeds in getting his or her fake answer accepted by the caching DNS server, the consequences are quite serious. The poisoned DNS entry can be used to redirect Web traffic, e-mail or any other IP application to a malicious server controlled by an attacker. Since the DNS points users to their destinations, it is completely unaware that the traffic is being diverted.

Protecting against the Kaminsky attack

As with any security vulnerability, the best approach for protecting against the Kaminsky attack is to employ multiple defenses. In this case, traditional firewalls and intrusion prevention systems (IPS) can be part of the solution, providing an initial defensive shield that will reduce the number of fake DNS query requests and responses.

But most firewalls and IPS will not stop a fake DNS response from poisoning the DNS cache if the DNS query parameters match. This means it is a primary consideration to ensure that the DNS server itself employs the best possible defenses. Put another way, DNS security starts with the DNS server.

Source: eweek.com

Open-source server distro builds on Ubuntu

Zaragoza, Spain-based eBox Technologies announced the availability of version 1.0 of its Ubuntu Linux-based eBox server distribution.The open source eBox 1.0 features LDAP, DHCP, NTP, DNS, and email servers, among other features, and provides a new development framework for building add-on modules, says the company.

Aimed primarily at small- and medium-sized business, but also supporting home and enterprise users, eBox combines numerous open source packages under an umbrella framework that is said to ease network management. Most of eBox's code works to manage the internal communication among otherwise-independent network services, says eBox Technologies. As a result, administrators can more easily manage IT infrastructure as a single unit, claims the company. For example, the object-based network management system is said to enable high-level management of IP addresses, easing the administration of the firewalls and other tools.

Major features listed for eBox 1.0 include:

* User management center -- The eBox OpenLDAP-based LDAP server stores sharable user and group accounts, and its primary domain controller enables Windows machines to authenticate against it, and provides roaming profiles.

* Shared resource manager -- Based on Samba and CUPS, the file and print servers support Windows networks with features including data backup, as well as assignment of user and group permissions levels.

* Communication center -- Features include email serving, storing mailboxes, filtering mail and viruses, relaying mail with selected filters, and instant messaging using the Jabber IM network. Other communications components are based on Postfix, Spamassassin, and ClamAV.

* Network gateway -- Network management features are said to include creating virtual interfaces and 802.1q-enabled trunk interfaces, as well as setting up a default gateway, static routes, and DNS server. eBox offers load balancing and traffic shaping features, as well as the ability to filter packets, perform NAT, and manage the access to all eBox services, says the company. Its caching HTTP proxy is said to accelerate web browsing and enable filtering pages based on content and black lists. Gateway components include Squid, DansGuardian, Netfilter/Iptables, and Iproute2.

* Infrastructure manager -- Compatible with the 802.1q switching protocol, eBox enables administrators to deploy network interfaces on several VLANs through one physical network interface, says the company. Its DHCP server enables the management and assignment of IP addresses, while the NTP server can sync its time and date with external NTP servers. eBox's DNS server provides for customizable name resolution, and the Apache web server shares public information by users using HTTP and Samba. A certificate authority enables the configuration of VPNs. The various servers and components are based on ISC DHCP, NTP, Bind, Apache, OpenSSL, and OpenVPN.

Source: desktoplinux.com/news/NS3601094260.html

Ways To Protect Your Network

Here are three free tricks to increase your network's security:-

1. Use OpenDNS

Use OpenDNS Internet traffic gets routed through IP addresses; the text you type as a URL only sits on top of those numbers. Normally, when you type pcworld.com, it gets referenced in a domain name server directory, which then routes you to the actual IP address. But what happens if that structure is compromised and an attacker can send your request to a different IP address?

Domain name servers and operating systems were eventually patched to protect against this attack. But the OpenDNS server already anticipated the problem and is quick to react to threats. Use it instead of relying on your ISP's DNS servers.

On the client side, you can open the Network Connections Control Panel. Right-click the active connection, and pick Properties. Select Internet Protocol (TCP/IP), and click Properties. Click the radio button to Use the following DNS server addresses and enter 208.67.222.222 and 208.67.220.220.

Or you can enable it on your router, sending DHCP clients these details without additional intervention. The specific process varies, but you'll essentially log in and enter those IP addresses in the NAT area.

2. Update Your Router Firmware

Psyb0t is a worm that was written to attack router hardware directly, embedding itself inside. It simply guesses the login and password for a range of routers, starting with the defaults. At the very least, you should be using a strong password, especially since many low-end routers don't let you change the login ID.

Just like your operating system, hardware companies typically patch routers over time, especially when security flaws are discovered. Look up your specific model and see if there's a firmware update. If so, download, and apply the revision; it'll likely protect you from many attacks.

3. Disable Remote Administration

In addition to updating your router firmware and giving it a strong password, you can close another door by disabling remote administration. This option is often off by default, but check your router's settings to tell for sure.

With remote administration on, someone can log in from offsite. They'll typically need a valid password, although this access presents another weak point in your defenses.

If you need to administrate the network remotely, set up a secure connection to a VPN gateway at your network, instead of connecting in that open method.

Source: .pcworld.com

DNS Physical Structure in Support of Active Directory

Source: http://technet.microsoft.com/

How to use DNS with Active Directory?

Active Directory relies heavily on DNS to function, but not just any DNS. Active Directory requires the DNS service found on Windows 2000 Server or Windows Server 2003 systems or equivalents.

If your network will be connected to the Internet in some way, you need to design and prepare your internal DNS structure to support Internet access (inbound, outbound or both). You have several options, including:

• Deploy a new fully qualified domain name hierarchy (i.e., namespace) on your internal network that is registered with the InterNIC. This means your internal LAN and the Internet have no logical distinction.
• Expand an existing InterNIC registered namespace, such as one for a Web or e-mail server, and expand it to support your private network. This is basically a variation of the first option.
• Use a sub-domain of an existing InterNIC registered namespace that is not currently being used on the Internet.
• Use a local namespace that exists only within your private network and that is not connected to a namespace on the Internet.
  

Using a namespace that exists both on your private network and on the Internet is not the most secure configuration. This configuration allows malicious users to easily obtain the names of your network servers and direct attacks against them. A simple NSLOOKUP command can provide anyone with a list of your registered systems. One method to help reduce this threat is to deploy dual DNS servers. Both DNS servers should be configured with primary zone authority over your namespace. Place one of the DNS servers inside your network (i.e., inside the firewall) and include all of your domain controllers and Internet servers in that zone. Place the other DNS server outside of your network and exclude all domain controllers from its zone.

Source: http://searchwinit.techtarget.com/tip/0,289483,sid1_gci891162,00.html

How to Use Dynamic DNS in Windows 2000 Professional

Windows 2000 Professional has a feature called Dynamic DNS (DDNS) that enables host records to be updated automatically in a Windows 2000 DNS server when the client address changes. This enables host records to remain accurate even when clients receive their address assignments through DHCP, for example.

A Windows 2000 Professional client can request an update to its host (A) record in the DNS server when its IP address or host name changes. A Windows 2000 DHCP server can also request an update to the associated pointer (PTR) record on behalf of its DHCP clients.

To configure a client for DDNS, follow these steps:

1. Open the Properties sheet for the network connection through the Network And Dial-Up Connections folder.
2. Double-click TCP/IP.
3. Go to Advanced | DNS.
4. Select the Register This Connection’s Addresses In DNS option to enable DDNS for the client.
   
5. Note: The Use This Connection’s DNS Suffix In DNS Registration option, if selected, registers the client using the first part of the computer name specified in the System properties along with the DNS suffix specified by the DNS Suffix For This Connection option.

Source: blogs.techrepublic.com.com