Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!think.com!zaphod.mps.ohio-state.edu!cis.ohio-state.edu!tut.cis.ohio-state.edu!ucbvax!ATHENA.MIT.EDU!tytso
From: tytso@ATHENA.MIT.EDU (Theodore Ts'o)
Newsgroups: comp.protocols.tcp-ip.domains
Subject: Re: enabling zone transfer and disabling nslookup's ls
Message-ID: <9105240349.AA25402@tsx-11.MIT.EDU>
Date: 24 May 91 03:49:47 GMT
References: <283BF5E9.1761@orion.oac.uci.edu>
Sender: daemon@ucbvax.BERKELEY.EDU
Reply-To: tytso@athena.mit.edu
Distribution: inet
Organization: The Internet
Lines: 39


   Date: 23 May 91 17:03:37 GMT
   From: meggers@walt.disney.com

   Can the response to the ls -<option> domain response be disabled, but
   still allow a zone transfer?

   I've looked at the code (University of Toronto's bind) briefly, and
   found a variable named xfr_disable, that when set disables ls domain.

   The question is, since it is labled for zone transfers, does this also
   disable zone transfers to servers that I delegate authority to?

Yes, it will disable zone transfers to servers as well as disallowing
the "ls -<option>" command in nslookup.  This is because the name server
can't tell the difference between the two casses.  In the latter case,
your secondary servers are sending the AFXR request to your named.  In
the first case, the nslookup program is sending the AFXR request.  Your
name daemon will respond identically in both cases, since it can't
determine which client issued the AFXR request.

I suppose if you really want to be paranoid about such things, you could
hack your name daemon to check the IP address before making a decision
about whether or not to honor an zone transfer request.  None of the
existing Unix implementations of the DNS, to my knowledge, support this,
although it wouldn't be hard to add.  Note, however, that unless your
secondary servers are also set to be fascist, someone would still be
able to find out what hosts you have by sending the zone transfer
request to your seconary servers.

Why do you want to be so fascist about zone transfers, anyway?  If
you're relying on people not knowing the names of your host as a
security mechanism, be advised this is a bad idea.  Attackers who know
how to use "ls -<option>" to nslookup can probably also try to see which
addresses in 39.104.1.* respond, and then figure out the names.
Alternatively, they could use just the internet address in lieu of the
name.

						- Ted