I'm running ISPConfig on an Ubuntu 6.10 server and it works just fine. I just got an e-mail from my ISP that DNS needs to be patched. Support for 6.10 has stopped, so I have 2 questions (upgrading to 8.04 LTS is not an option at the moment I'm afraid): - since apt no longer works, where can I download the correct packages - once I have these, how do I install them Thanks in advance.
I assume this is referring to the recent DNS cache exploit. Are you running a DNS cache or recursive resolver?
Oops, got me there. The server is running ISPConfig set up as per the Perfect Server setup (for Ubuntu 6.10). Does this help?
Here's the output (for obvious reasons I tweaked the actual domainnames): root@server:~# ls -la /etc/bind/ total 140 drwxr-sr-x 2 bind bind 4096 2008-06-06 14:06 . drwxr-xr-x 3 root root 4096 2007-02-01 12:58 .. -rw-r--r-- 1 bind bind 237 2006-10-05 21:44 db.0 -rw-r--r-- 1 bind bind 271 2006-10-05 21:44 db.127 -rw-r--r-- 1 bind bind 237 2006-10-05 21:44 db.255 -rw-r--r-- 1 bind bind 353 2006-10-05 21:44 db.empty -rw-r--r-- 1 bind bind 256 2006-10-05 21:44 db.local -rw-r--r-- 1 bind bind 1506 2008-01-11 15:16 db.root -rw-r--r-- 1 root root 1659 2008-06-06 14:02 named.conf -rw-r--r-- 1 root root 1576 2008-06-06 14:02 named.conf~ -rw-r--r-- 1 bind bind 165 2006-10-05 21:44 named.conf.local -rw-r--r-- 1 bind bind 1435 2006-10-05 21:44 named.conf.options -rw-r--r-- 1 root root 560 2008-06-06 14:02 pri.0.0.10.in-addr.arpa -rw-r--r-- 1 root root 1267 2008-06-06 14:02 pri.0.0.10.in-addr.arpa~ -rw-r--r-- 1 root root 776 2008-01-30 13:44 pri.mydomain.at -rw-r--r-- 1 root root 775 2008-01-30 13:44 pri.mydomain.at~ -rw-r--r-- 1 root root 799 2007-02-27 13:27 pri.mydomain.be -rw-r--r-- 1 root root 842 2007-02-27 13:27 pri.mydomain.be~ -rw-r--r-- 1 root root 775 2008-01-30 13:47 pri.mydomain.ch -rw-r--r-- 1 root root 1013 2007-02-27 14:09 pri.mydomain.com -rw-r--r-- 1 root root 1069 2007-02-27 14:09 pri.mydomain.com~ -rw-r--r-- 1 root root 775 2008-01-30 13:51 pri.mydomain.de -rw-r--r-- 1 root root 737 2007-02-27 13:27 pri.mydomain.eu -rw-r--r-- 1 root root 780 2007-02-27 13:27 pri.mydomain.eu~ -rw-r--r-- 1 root root 777 2008-06-06 14:06 pri.mydomain.nl -rw-r--r-- 1 root root 775 2008-06-06 14:06 pri.mydomain.nl~ -rw-r--r-- 1 root root 811 2008-01-30 13:48 pri.myseconddomain.com -rw-r--r-- 1 root root 734 2008-01-30 13:48 pri.myseconddomain.com~ -rw-r--r-- 1 root root 783 2007-02-26 15:19 pri.mythirddomain.be -rw-r--r-- 1 root root 778 2007-02-26 15:19 pri.mythirddomain.be~ -rw-r--r-- 1 root root 821 2008-01-30 13:50 pri.myfourthdomain.nl -rw-r--r-- 1 root root 741 2008-01-30 13:50 pri.myfourthdomain.nl~ -rw-r--r-- 1 root root 788 2008-06-06 14:02 pri.mylatestdomain.nl -rw-r----- 1 bind bind 77 2007-02-01 12:56 rndc.key
root@server:/# more ./var/lib/named/etc/bind/named.conf options { pid-file "/var/run/bind/run/named.pid"; directory "/etc/bind"; auth-nxdomain no; /* * If there is a firewall between you and nameservers you want * to talk to, you might need to uncomment the query-source * directive below. Previous versions of BIND always asked * questions using port 53, but BIND 8.1 uses an unprivileged * port by default. */ // query-source address * port 53; }; // // a caching only nameserver config // zone "." { type hint; file "db.root"; }; zone "0.0.127.in-addr.arpa" { type master; file "db.local"; }; zone "0.0.10.in-addr.arpa" { type master; file "pri.0.0.10.in-addr.arpa"; }; zone "mydomain.com" { type master; file "pri.mydomain.com"; }; zone "mydomain.be" { type master; file "pri.mydomain.be"; }; zone "mydomain.eu" { type master; file "pri.mydomain.eu"; }; zone "mydomain.be" { type master; file "pri.mydomain.be"; }; zone "mydomain.eu" { type master; file "pri.mydomain.eu"; }; zone "mydomain2.be" { type master; file "pri.mydomain2.be"; }; zone "mydomain3.com" { type master; file "pri.mydomain3.com"; }; zone "mydomain4.nl" { type master; file "pri.mydomain4.nl"; }; zone "mydomain.at" { type master; file "pri.mydomain.at"; }; zone "mydomain.ch" { type master; file "pri.mydomain.ch"; }; zone "mydomain.de" { type master; file "pri.mydomain.de"; }; zone "mydomain.nl" { type master; file "pri.mydomain.nl"; }; zone "mydomain5.nl" { type master; file "pri.mydomain5.nl"; }; //// MAKE MANUAL ENTRIES BELOW THIS LINE! //// root@server:/#
What happens when you add Code: allow-recursion { none; }; dnssec-enable yes; to the options stanza, restart BIND, and run the dig +short command? (See http://www.howtoforge.com/how-to-patch-bind-to-avoid-cache-poisoning-debian-etch )
