The key here is that if you're going to spend time faking the real response of a query that time may be best spent fixing the real problem. People who will now complain about the number of machines they need to upgrade, etc.. should now evaluate the costs of running an internet connected network. If these costs or risks are too high for you perhaps you need to evaluate your internet connection policies. - Jared On Tue, Jan 30, 2001 at 09:32:24PM +0000, bmanning@vacation.karoshi.com wrote:
lets see... (from previous discussions on the usefullness of tweeking the version)
wearing my blackhat, i have to decide which system is worthty of my talents... which one should I pick?
version "bad-ass-bind"; -or- version "9.1.0"
of course I could be running 4.8.1 and simply recompile so it _reports_ a bogus version but the profile of a 9.1.0 code base is -very- distinct from a 4.8.1 code base... esp on replies to queries.
Pick your targets carefully.
Why not jus return some 'bogus' version ??? like this option allows:
version "bad-ass-bind";
:)
--Chris
####################################################### ## UUNET Technologies, Inc. ## ## Manager ## ## Customer Router Security Engineering Team ## ## (W)703-289-8479 (C)703-283-3734 ## #######################################################
On Tue, 30 Jan 2001, Stephen Stuart wrote:
While it's not exactly a problem, it does give away that you're running bind9 (I do like the new 'version' option where you can set the version.bind reply) even if you change the version to appear to be a bind8 server.
"allow-query" lets you control who can see that information:
zone "bind" chaos { allow-query { 127.0.0.1 ; xxx.xxx.xxx.xxx/len ; } ; type master; file "filename"; };
Stephen
-- Jared Mauch | pgp key available via finger from jared@puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine. END OF LINE | Manager of IP networks built within my own home