Allow transfer zone [DNS Service]

Question

Level 1

8 points

Allow transfer zone [DNS Service]

Hi,

I'd like to know what does "Allow Transfer Zone option" means in the created zone of a DNS service?

Is it good or bad?

I think that if this options in enabled ... another Administrator can publish your created zone in other DNS Server? so I think that it's bad an little bit insecure no?

Thanks

Posted on Jul 21, 2009 1:28 PM

Reply

Answer 1

Jul 21, 2009 2:40 PM in response to jonflas

I'd like to know what does "Allow Transfer Zone option" means in the created zone of a DNS service?

It allows another DNS server to transfer the zone information that your DNS server is authoritative for. Normally this would be allowed only for master/slave servers within your organization. Usually the ' allow-transfer { addressmatchlist };' option is accompanied by a list of IP numbers of the master/slave servers that you wish to transfer zone information to. The ' addressmatchlist', in the option, is a comma separated list of dotted quad IP numbers for the allowed servers. Zone transfers are usually controlled with a cryptographic secret to authorize the transfer and prevent servers from 'spoofing' their identity as a trusted host. No key == no zone transfer.

Is it good or bad?

Its primary purpose is to speed up the resolution of DNS requests for other DNS servers that would be querying your zone on a regular basis for name resolution. If you have a number of internal DNS servers that need to resolve hosts in your organization you would normally allow zone transfers to those servers by adding their IP numbers to the ' addressmatchlist' portion of the option. This would reduce lookup times for hosts that query those DNS servers. So, yes, it is a good thing.

Reply

Answer 2

MrHoffman

Level 10

146,641 points

Jul 21, 2009 2:44 PM in response to jonflas

Zone transfers from your own secondary DNS servers, seeking to synchronize with the primary DNS server? Good. Zone transfers from other DNS servers outside your control or from attackers? Not so good. The former helps your DNS servers stay synchronized. The latter avoids exposing most information about your network than you might otherwise wish.

Reply

Answer 3

jonflas Author

Level 1

8 points

Jul 21, 2009 10:43 PM in response to MrHoffman

Thanks u for ur responses,

so if I would wish zone transfer between primary dns and my secondary serves, I must to enable that option in server admin, isnt it? And I must to specify the IPs of my secondary dns as a valid but ... Where? In which file I have to write that directive:

'allow-transfer { address matchlist };'

that's the way to have a good zone dns transfer implemented,isnt it?

Thanks,

Reply

Answer 4

Jul 21, 2009 11:36 PM in response to jonflas

If you choose to edit the configuration files for your DNS by hand, stop the DNS service first before doing so.

Open /etc/named.conf in a plaintext editor like 'TextWrangler'. Add the line under the 'options' section like this:

options {
include "/etc/dns/options.conf.apple";
allow-transfer { 123.45.67.89,123.45.67.98 };
};

where '123.45.67.89' and '123.45.67.98' are the IP numbers of your slave or secondary DNS servers.

Reply

Answer 5

jonflas Author

Level 1

8 points

Jul 22, 2009 9:34 AM in response to Mabel O'Farrell

Okay, perfect, but ... when I add that line to /etc/named.conf file, must I disabled "Allow Zone Transfer" of a zone in the Server Admin?

Now, I have enable "Allow Zone Transfer" for all my zones because I thought that it was necessary to share zones between Primary DNS and Secondaries ...

Well ... Another question is ... what is the hand configuration in /etc/named.conf when "Allow Zone Transfer" is enable via Server Admin?

Thanks for ur help!!!

Álvaro.

Reply

Answer 6

Jul 22, 2009 9:43 AM in response to jonflas

Okay, perfect, but ... when I add that line to /etc/named.conf file, must I disabled "Allow Zone Transfer" of a zone in the Server Admin?

Yes. you will have to uncheck that in Server Admin because SA will put that option into the file /private/etc/dns/options.conf.apple which might result in conflicting information.

Reply

Answer 7

jonflas Author

Level 1

8 points

Jul 22, 2009 11:44 AM in response to Mabel O'Farrell

Ok,

but I make a cat of a that file and I can see the following:

sh-3.2# cat /private/etc/dns/options.conf.apple
//
// These are the options that are shown in Server Admin
// This is an automatically generated file.
// PLEASE DO NOT MANUALLY MODIFY THIS FILE!
// Please make your changes in the named.conf file
//
directory "/var/named";

forwarders {};

allow-transfer { none; };

allow-transfer directive is a none value, but I have enable it in ALL my domains via server admin, so I think that SA save that information in another file , isnt it?

thanks for all 😉

Reply