DNS设定常见的错误及注意事.ppt

DNS設定上常見的錯誤及注意事項 陳昌盛 交通大學計算機與網路中心 2002.04.10 Outline Introduction Common DNS Problems Common DNS Configuration Errors Examples Cases Study Discussions Concluding remarks References Appendix 1. Introduction DNS and the Internet Software Infrastructure for the Internet Poorly-performed DNS server everywhere The hierarchical and distributed nature of DNS makes it hard for ordinary administrators to gain expertise Configured once and possibly used for a long time A Sample Statistics from MOECC Background knowledge DNS Traffic Profiling, source data from TW-MOECC Newsletter, .tw/ Background knowledge DNS Basics A simple DNS working model Hierarchical Structure DNS-related Issues for Study Correctness, Availability, Performance, Security DNS related programs client, proxy, server DNS server program (e.g. BIND/named, …) DNS debugging tools (e.g. nslookup, dig, …) DNS Configuration tools DNS Basics DNS (Domain Name System) Domain Name Space Distributed and hierarchical Naming Structure tree-structure vs. DAG-structure Geographical vs. organizational naming principles Domain Name Server (server side) BIND/named, ... Domain Name Resolver (client side) Type of servers Master, slave, caching, forwarding, … Type of zones Forward, reverse,… A Simple Working Model (cont.) 2. Common DNS Problems Common configuration errors or attacks ? Simple Classification of Common DNS Problems How can I figure out whats wrong? Tools for identifying the problems Dig, nslookup, etc Tcpdump Aguri, mrtg Table 1. Simple Classification of Common DNS Problems Common Type of DoS Attacks to DNS Servers Network Layer DoS attacks Ping-of-death (Smurf,…) UDP, ICMP Application Layer DoS Attacks UDP Lamer Server, DNS forwarding storm, unknown SPAM Mail, direct attacks (mal-function client/server) TCP 3. Configuration error or Attacks ? Major problems Lame Server Bogus DNS queries CName NS RR’s pointed to Cname RR’s MX RR’s pointed to Cname RR’s DNS forwarding Storm Indirect intrusion (PTR) Config