Debug School

rakesh kumar
rakesh kumar

Posted on • Updated on

How to Restrict zone transfers for securing DNS server in linux with examples

list of IP addresses or IP address ranges that are allowed to perform zone transfers

list of servers that should be notified when the zone is updated

Restricting zone transfers is an important step in securing a DNS server. Zone transfers can allow an attacker to obtain a complete copy of a DNS zone file, which can be used to launch various types of attacks. Here are the steps to restrict zone transfers in a Linux DNS server using command-line tools:

Edit the named.conf file: The first step is to edit the configuration file for the DNS server, named.conf. You can use a text editor like "nano" or "vim" to open the file. The location of the file may vary depending on the Linux distribution and the DNS server software being used.

Add the "allow-transfer" option: Within the "options" section of the named.conf file, add the "allow-transfer" option followed by a list of IP addresses or IP address ranges that are allowed to perform zone transfers. For example, to allow only the IP address 192.168.1.100 to perform zone transfers, add the following line:

allow-transfer { 192.168.1.100; };
Enter fullscreen mode Exit fullscreen mode

You can also use CIDR notation to specify an IP address range. For example, to allow a range of IP addresses from 192.168.1.100 to 192.168.1.200, you can use the following line:

allow-transfer { 192.168.1.100/24; };
Enter fullscreen mode Exit fullscreen mode

Add the "also-notify" option: You can also add the "also-notify" option to specify a list of servers that should be notified when the zone is updated. This can help to ensure that changes are propagated to all servers in a timely manner. For example, to notify the server at IP address 192.168.1.101, add the following line:

also-notify { 192.168.1.101; };
Enter fullscreen mode Exit fullscreen mode

Restart the DNS server: After making changes to the named.conf file, you need to restart the DNS server to apply the changes. You can use the following command to restart the BIND DNS server:

sudo systemctl restart named
Enter fullscreen mode Exit fullscreen mode

By following these steps, you can restrict zone transfers to only authorized servers and help to secure your DNS server against potential attacks.

Top comments (0)