Description of problem: Currently bind is shipped with no default named.conf. From the statistics related to the recent "open resolver" attacks it implied that the current default bind configuration on Red Hat Enterprise Linux 5 leads to practices when the default configuration is also used for DNS resolver settings for Internet connections. Due to lack of default named.conf warning messages inexperienced administrators previously tended to simply allow all traffic, allowing the server in question to participate on distributed denial of service attacks (to mention some example why the default configuration should not be used for Interned connections). Default named.conf with warnings should prevent such misconfigurations to happen in the future. Version-Release number of selected component (if applicable): bind-9.3.6-20.P1.el5_8.6 Actual results: No default named.conf with explicit warning about allow-query and allow-query-cache directives.
How about in the stock named.conf along the lines of: /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */
Thank you Paul for the warning message. It looks reasonable to me. If you don't mind I would like to use the same warning in named.conf distributed in Fedora.
please do
This request was evaluated by Red Hat Product Management for inclusion in the current release of Red Hat Enterprise Linux. Because the affected component is not scheduled to be updated in the current release, Red Hat is unable to address this request at this time. Red Hat invites you to ask your support representative to propose this request, if appropriate, in the next release of Red Hat Enterprise Linux.
This bug/component is not included in scope for RHEL-5.11.0 which is the last RHEL5 minor release. This Bugzilla will soon be CLOSED as WONTFIX (at the end of RHEL5.11 development phase (Apr 22, 2014)). Please contact your account manager or support representative in case you need to escalate this bug.
Thank you for submitting this request for inclusion in Red Hat Enterprise Linux 5. We've carefully evaluated the request, but are unable to include it in RHEL5 stream. If the issue is critical for your business, please provide additional business justification through the appropriate support channels (https://access.redhat.com/site/support).