DNS
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me

The Shed is going Social! Join us on FaceBook and Twitter and chime in on the conversation.

Go Back   Dev Shed Forums > System Administration > DNS
Reload this Page

Configuring DNS BIND RPZ


Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old January 19th, 2012, 12:24 AM
studabc studabc is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jan 2012
Posts: 7 studabc User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 44 m 41 sec
Reputation Power: 0
Configuring DNS BIND RPZ
May i know what's the steps to configure Response Policy Zone in BIND 9.8.1??
Reply With Quote
  #2  
Old January 19th, 2012, 10:56 AM
CaptPikel CaptPikel is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Nov 2010
Location: Florida
Posts: 248 CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level) 
Time spent in forums: 3 Days 15 h 26 m 11 sec
Reputation Power: 3
There are articles on setting up RPZ's but I honestly haven't really attempted it. I read the RFC but never actually did it.

Here's an article in French but it has an example of the Options and Zone data. It looks pretty straightforward:
http://dns.blog4ever.com/blog/lire-article-491870-2332506-rpz_et_dns__exemple_de_configuration.html


Here's the RFC on it as well with some good stuff in it:
http://ftp.isc.org/isc/dnsrpz/isc-tn-2010-1.txt
Reply With Quote
  #3  
Old January 25th, 2012, 12:32 AM
studabc studabc is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jan 2012
Posts: 7 studabc User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 44 m 41 sec
Reputation Power: 0
I've tried to follow the link that you've gave me, under the configuration of db.rpz.zone. How come after the configuration, it still didn't block the IP Address?
Reply With Quote
  #4  
Old January 25th, 2012, 09:36 AM
CaptPikel CaptPikel is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Nov 2010
Location: Florida
Posts: 248 CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level) 
Time spent in forums: 3 Days 15 h 26 m 11 sec
Reputation Power: 3
Is named starting after the config change? Are you running BIND 9.8?
Reply With Quote
  #5  
Old January 25th, 2012, 10:04 AM
CaptPikel CaptPikel is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Nov 2010
Location: Florida
Posts: 248 CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level) 
Time spent in forums: 3 Days 15 h 26 m 11 sec
Reputation Power: 3
A quick update, I installed BIND 9.8 on a test machine and literally copy/pasted what was on that website in to the configuration and it worked right off. Make sure you have no typos and are running BIND 9.8.


Code:
/etc/bind# dig @127.0.0.1 google.com.

; <<>> DiG 9.8.1-P1 <<>> @127.0.0.1 google.com.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25967
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             10      IN      A       127.0.0.17

;; AUTHORITY SECTION:
rpz.zone.               10      IN      NS      localhost.

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Jan 25 10:06:43 2012
;; MSG SIZE  rcvd: 75
Reply With Quote
  #6  
Old January 25th, 2012, 10:04 PM
studabc studabc is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jan 2012
Posts: 7 studabc User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 44 m 41 sec
Reputation Power: 0
I'm running on BIND 9.8.1..
Reply With Quote
  #7  
Old January 25th, 2012, 10:17 PM
CaptPikel CaptPikel is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Nov 2010
Location: Florida
Posts: 248 CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level) 
Time spent in forums: 3 Days 15 h 26 m 11 sec
Reputation Power: 3
Does named start? What exactly is happening after you make the zone and the config. You might want to check the server logs for any named entries to see if the zone isn't loading.
Reply With Quote
  #8  
Old January 26th, 2012, 02:35 AM
studabc studabc is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jan 2012
Posts: 7 studabc User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 44 m 41 sec
Reputation Power: 0
What do you mean by does named start? The ISC BIND has started in the services.
I've created two zones under named.config, one is the iadlp.cng.com and another one is the rpz.zone which I've followed through the website that you've gave me in the previous reply.

C:\named\bin>dig @127.0.0.1 google.com.

; <<>> DiG 9.8.1-P1 <<>> @127.0.0.1 google.com.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39848
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 13, ADDITIONAL: 12

;; QUESTION SECTION:
;google.com. IN A

;; ANSWER SECTION:
google.com. 198 IN A 74.125.235.51
google.com. 198 IN A 74.125.235.52
google.com. 198 IN A 74.125.235.48
google.com. 198 IN A 74.125.235.49
google.com. 198 IN A 74.125.235.50

;; AUTHORITY SECTION:
. 13395 IN NS i.root-servers.net
. 13395 IN NS j.root-servers.net
. 13395 IN NS m.root-servers.net
. 13395 IN NS k.root-servers.net
. 13395 IN NS l.root-servers.net
. 13395 IN NS a.root-servers.net
. 13395 IN NS h.root-servers.net
. 13395 IN NS g.root-servers.net
. 13395 IN NS b.root-servers.net
. 13395 IN NS f.root-servers.net
. 13395 IN NS c.root-servers.net
. 13395 IN NS d.root-servers.net
. 13395 IN NS e.root-servers.net

;; ADDITIONAL SECTION:
a.root-servers.net. 72188 IN A 192.41.0.4
a.root-servers.net. 36064 IN A 192.228.79.201
a.root-servers.net. 71186 IN A 192.33.4.12
a.root-servers.net. 71327 IN A 128.8.10.90
a.root-servers.net. 85834 IN A 192.203.230.10
a.root-servers.net. 36096 IN A 192.5.5.241
a.root-servers.net. 68021 IN A 192.112.36.4
a.root-servers.net. 36122 IN A 128.63.2.53
a.root-servers.net. 71196 IN A 192.36.148.17
a.root-servers.net. 27161 IN A 192.58.128.30
a.root-servers.net. 72160 IN A 193.0.14.129
a.root-servers.net. 67622 IN A 199.7.83.42

;; Query time: 9 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Jan 26 15:20:57 2012
;; MSG SIZE rcvd: 511
Reply With Quote
  #9  
Old January 26th, 2012, 03:17 PM
CaptPikel CaptPikel is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Nov 2010
Location: Florida
Posts: 248 CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level) 
Time spent in forums: 3 Days 15 h 26 m 11 sec
Reputation Power: 3
I would suggest checking your logs. The process for BIND is called "named". You will want to check the logs for anything logged by named for errors. If you have restarted the named process after the config change and it still queries the internet, that means named is running but it seems like the rpz zone didn't load. The logs will usually tell you why.
Reply With Quote
  #10  
Old January 26th, 2012, 07:19 PM
studabc studabc is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jan 2012
Posts: 7 studabc User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 44 m 41 sec
Reputation Power: 0
I'm sorry to ask, but may i know how am I suppose to check for my logs?
Reply With Quote
  #11  
Old January 26th, 2012, 07:33 PM
CaptPikel CaptPikel is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Nov 2010
Location: Florida
Posts: 248 CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level) 
Time spent in forums: 3 Days 15 h 26 m 11 sec
Reputation Power: 3
If it's a nix system, you want to check /var/log/messages or /var/log/syslog. Use grep and search "named" in whichever log your system is logging info to and it should have some information in it.
Reply With Quote
  #12  
Old January 26th, 2012, 07:42 PM
studabc studabc is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jan 2012
Posts: 7 studabc User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 44 m 41 sec
Reputation Power: 0
I'm running on Windows 7. So i can use grep as well?
Reply With Quote
  #13  
Old January 26th, 2012, 08:02 PM
CaptPikel CaptPikel is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Nov 2010
Location: Florida
Posts: 248 CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level) 
Time spent in forums: 3 Days 15 h 26 m 11 sec
Reputation Power: 3
No, if it's windows you should probably check out the Event Viewer in admin tools in the control panel. I'm guessing it would probably under the applications section.
Reply With Quote
  #14  
Old January 26th, 2012, 09:09 PM
studabc studabc is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jan 2012
Posts: 7 studabc User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 44 m 41 sec
Reputation Power: 0
Checked the Event Viewer and saw some of the errors which consist of:
  • zone rpz.zone/IN: loading from master file db.rpz.zone failed: file not found
  • zone rpz.zone/IN: not loaded due to errors.
  • zone iadlp.cng.com/IN: not loaded due to errors.
  • unable to convert errno to isc_result: 1450: Insufficient system resources exist to complete the requested service.

Have any ideas what does all these means?
Reply With Quote
  #15  
Old January 27th, 2012, 06:09 PM
CaptPikel CaptPikel is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Nov 2010
Location: Florida
Posts: 248 CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level)CaptPikel User rank is Lance Corporal (50 - 100 Reputation Level) 
Time spent in forums: 3 Days 15 h 26 m 11 sec
Reputation Power: 3
I'm not too familiar with running BIND on windows since I only use it on linux/unix systems, so I'm not sure if there is a default directory you should look in or if it's something you specified. But you have to have the db.rpz.zone in the correct directory (the one mentioned in your named.conf file. It looks like from the log, the specified zone file isn't there so it's not being loaded (and problems with another zone you have). If the local files are not found or formatted incorrectly, named will still start up but the bad zones will not be loaded. So named cannot answer from those local files (like it would in the case of an rpz).
Reply With Quote
Reply

Viewing: Dev Shed Forums > System Administration > DNS > Configuring DNS BIND RPZ

« Previous Thread | Next Thread »

Developer Shed Advertisers and Affiliates



Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 


Powered by: vBulletin Version 3.0.5
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.

© 2003-2013 by Developer Shed. All rights reserved. DS Cluster - Follow our Sitemap