[ILUG] domain-jacking

[James Raftery]

On Mon, Jan 10, 2000 at 06:24:51PM +0000, Robert Elliott wrote:
> A couple of rather bizarre lines appeared in my logs today:
> Jan 10 05:53:11 leviathan named[27650]: approved AXFR from
> [209.112.56.46].3680 for "irelands-web.ie"
> Jan 10 05:53:11 leviathan named[27650]: zone transfer (AXFR) of
> "irelands-web.ie" (IN) to [209.112.56.46].3680
> 
> >From what I gather from the scant information I can find on the web, if
> this is deliberate it's probably a precursor to a cracking attempt
> rather than a heinous plot to nick our domain. In any case, it's not the
> sort of thing I like to see appearing in the logs. So:
> 1. Does anyone know what's happening?

209.112.56.46 made an AXFR query to your nameserver for your zone,
a.k.a. it did a 'zone transfer'. 
It's not very unusual. There's a regularly recurring debate in
comp.protocols.dns.bind and comp.protocols.tcp-ip.domains about whether
zone transfer should be allowed or not. Personally I say no, but others
disagree.

> 2. Does anyone know how to stop it?

Add an 'allow-transfer {};' directive to the zone statement for your 
zone(s) in your named.conf.
See http://www.isc.org/products/BIND/docs/config/zone.html

> 3. What is port 3680?

The source port of the query came from. When BIND makes a query it uses
a random high-numbered source port.

> 209.112.56.46 is compuoffice.com ; I imagine they're innocent bystanders
> in all this. 

You never know...mwwaaahahahaha :)

james
-- 
James Raftery (JBR54) - Programmer Hostmaster   IE Domain Registry
Preferred Contact by Email: hostmaster at ucd.ie   UCD Computing Services
Web: http://www.domainregistry.ie/              Computer Centre
Tel: (+353 1) 7062375 Fax: (+353 1) 7062862     Belfield, Dublin 4, IE