Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

Im working on a script that's going to talk to a DNS on a LAN that have information about local domains. And I believe its blocking my requests.

So my question is: How can you limit a DNS server to only handle request from some clients and not all clients true different authentication methods?

share|improve this question
1  
Can you expand on this question a little? From your comment below it sounds like it's a Microsoft DNS server but perhaps not one you manage. Is the script for administration purposes or are you performing a pentest (or similar)? What symptoms lead you to believe you are being blocked? Network traffic being dropped or DNS responds with some form of rejection? What types of queries are you performing? – Marc Wickenden Apr 13 '11 at 20:58

2 Answers

up vote 2 down vote accepted

Most DNS servers support views -- the idea that different data will be presented to clients depending on their IP address. ACLs per IP address are also frequently supported for individual functions (e.g. BIND's allow-query, allow-transfer and allow-recursion clauses).

It's possible your IP is not allowed to query a specific server (or zone), that the view you see doesn't contain the zone, or that you are not allowed to make recursive queries.

share|improve this answer
Thank you, do you know of any documentation on how this works? line in what way you can create a zone? – KilledKenny Apr 22 '11 at 18:16
"how it works" is pretty basic: The server looks at your IP and selects a view, then looks at the ACL for the action you're trying to take and decides if you're allowed to do what you're asking. I'm not a Windows guy so I don't know of any good documentation for Microsoft's DNS server, but O'Reilly's "DNS and BIND" book and the BIND manual (bind9.net/manuals) both go into detail on the options I mentioned above. – voretaq7 Apr 22 '11 at 19:19
up vote 1 down vote

DNS don't provide a client authentication mechanic. What you can do is provide different views to different machines but only based on IP addresses.

Views in Bind 9

share|improve this answer
I'm not really interested in Bind I think that the system I'm asking about is Microsoft dns. – KilledKenny Apr 11 '11 at 18:55
@WZeberaFFS MS DNS definitely does support access control, but I really don't remember the details... – AviD♦ Apr 11 '11 at 20:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.