Portál AbcLinuxu, 16. července 2025 05:03
Bezim DNS server (na 127.0.0.1) pre masiny patriace do mojej domeny (medzi ktore patri aj stroj, ale nie je znamy vonkajsiemu svetu.
/etc/resolv.conf ma
domain domena.sk nameserver 127.0.0.1 nameserver 192.168.1.151 moj backup DNS nameserver ISP dns/etc/named.conf ma (okrem ineho)
zone "0.0.127.in-addr.arpa" { type master; file "named.local"; allow-update { none; }; }; zone "domain.sk" { type master; notify no; file "domain.sk"; };Napriek tomu sa mi zda, ze ssh stroj sposobi DNS query, ktora ide az na root-DNS miesto toho aby bola zodpovedana mojim serverom na 127.0.0.1.
Vidite niekde ten zadrhel?
Mimochodom je to normalne, ze dig 127.0.0.1 povie:
;; AUTHORITY SECTION: . 10780 IN SOA A.ROOT-SERVERS.NET. NSTLD.VERISIGN-GRS.COM. 2003091801 1800 900 604800 86400Root-DNS autoritativny pre 127.0.0.1?
Poslal som tu cast named.conf, co podla mna moze vplyvat na problem, ktory mam, ale budiz:
options { directory "/var/named"; }; zone "." { type hint; file "named.ca"; }; zone "localhost" { type master; file "localhost.zone"; allow-update { none; }; }; zone "0.0.127.in-addr.arpa" { type master; file "named.local"; allow-update { none; }; }; zone "domain.sk" { type master; notify no; file "domain.sk"; }; zone "1.168.192.in-addr.arpa" { type master; notify no; file "192.168.1"; };Najaky napad?
Ale mam dalsi kusok do mozaiky: pustil som si 'tcpdump lo' tam som sa docital:
14:53:53.388133 localhost.1791 > localhost.domain: 35379+ AAAA? stroj.domena.sk. (32) (DF) 14:53:53.390489 localhost.domain > localhost.1791: 35379* 0/1/0 (79) (DF) 14:53:53.391697 localhost.1791 > localhost.domain: 35380+ AAAA? stroj. (22) (DF) 14:53:53.393162 localhost.domain > localhost.1791: 35380 NXDomain 0/1/0 (97) (DF) 14:53:53.394483 localhost.1791 > localhost.domain: 27505+ A? stroj.domena.sk. (32) (DF) 14:53:53.396286 localhost.domain > localhost.1791: 27505* 1/1/1 A stroj.domena.sk (84) (DF) 14:53:53.397589 localhost.1791 > localhost.domain: 27506+ PTR? 120.1.168.192.in-addr.arpa. (44) (DF) 14:53:53.399294 localhost.domain > localhost.1791: 27506* 1/1/1 (108) (DF)Kdezto obycajne gethostbyname() ten zvyrazneny paket nevyrobi. Co tam ten telnet caruje?
Tiskni
Sdílej:
ISSN 1214-1267, (c) 1999-2007 Stickfish s.r.o.