Saw this post at TaoSecurity today about using DNS as a tool for Asset Management.
http://taosecurity.blogspot.com/2009/02/asset-management-assistance-via-custom.html
It toys with the thought of creating custom DNS records that identify asset owners. It's an interesting thought that was partially used at my last job. Our senior sysadmin had an unwritten policy that any server added to our internal DNS would also need a TXT record that contained information such as the hardware serial number. I'm not sure how many characters a TXT record supports, but I'm sure you could add other info as well. If you weren't sure who the contact person for a server was, or where it was located, you could "dig servername txt".
Here's an example of a DNS TXT record entry.
http://www.zytrax.com/books/dns/ch8/txt.html
Showing posts with label DNS. Show all posts
Showing posts with label DNS. Show all posts
Thursday, February 26, 2009
Monday, May 5, 2008
Problem with slave BIND server
After one of the sysadmins at work patched our RHEL4 DNS servers, I noticed our slave server was not successfully receiving updated zone files from the master.
Looking at the logs, I kept seeing the following error
named[5182]: dumping master file: tmp-XXXXTCPn1l: open: permission denied
I installed strace on the server and tried to find where it was trying to write to and see if somehow the directory permissions were incorrect. Unfortunately, strace just showed the "tmp-XXXXX" file failing, but not the directory location.
After some investigation on Google, I found this site. It explained that an updated version of BIND required changes to the named.conf file for slave DNS servers. I then modified our named.conf so that the setting for the zone file was
file "slaves/example.com.zone";
instead of the
file "example.com.zone";
I'm not sure how it worked in the past. Perhaps Red Hat backported an update in BIND that was not initially in RHEL4? I don't know what the Update version was before the patching, else I could probably dig through release notes. However, if you're seeing strangeness with your slave BIND servers, I'd check to make sure your named.conf isn't out of date.
Looking at the logs, I kept seeing the following error
named[5182]: dumping master file: tmp-XXXXTCPn1l: open: permission denied
I installed strace on the server and tried to find where it was trying to write to and see if somehow the directory permissions were incorrect. Unfortunately, strace just showed the "tmp-XXXXX" file failing, but not the directory location.
After some investigation on Google, I found this site. It explained that an updated version of BIND required changes to the named.conf file for slave DNS servers. I then modified our named.conf so that the setting for the zone file was
file "slaves/example.com.zone";
instead of the
file "example.com.zone";
I'm not sure how it worked in the past. Perhaps Red Hat backported an update in BIND that was not initially in RHEL4? I don't know what the Update version was before the patching, else I could probably dig through release notes. However, if you're seeing strangeness with your slave BIND servers, I'd check to make sure your named.conf isn't out of date.
Subscribe to:
Posts (Atom)
Posts
