cache snooping attacks

This is a bug and should be pursued with support.  A client can request Dns lookuos with or without recursion.  If yhe client does not have the authoritative answer, it should return s pointer about where to look next.  It should not recurse to find the answer.   Spparently UTM is doing recursion even when it is soecifically told not to do so.

This is a bug and should be pursued with support.  A client can request Dns lookuos with or without recursion.  If yhe client does not have the authoritative answer, it should return s pointer about where to look next.  It should not recurse to find the answer.   Spparently UTM is doing recursion even when it is soecifically told not to do so.

What has changed in the behavior of "allow-recursion" and "allow-query-cache" gives you the modifications you can make to /var/chroot-bind/etc/named.conf, Doug.  After that: /var/mdw/scripts/named restart

Kip, I would not use the UTM as a primary, internal DNS server except in a very, very small office.  That said, internal DNS servers could have the same exposure.

Cheers - Bob

NOTE: Edited substantially an hour later than the time stamp - I didn't realize that much time had passed!

Nothing to do with config.  A dns server should answer the client question the way it is asked.   If the client says "do not recurse" then it should not recurse.  Seems like a basic issue of RFC and securtity compliance.

Thanks BAlfson I do consider my PCI scoped environment to be a very small office with only about 24 devices in all (sophos, 2 switches, splunk, and 2 KVM hosts with about 8 KVM guests each). Have not seen any issues with DNS, NTP, nor DHCP for this environment. Anything more and I definitely would stand up a couple of servers for DNS, 2 more for NTP, and just forget about DHCP. For PCI I am stretching the single function per server paradigm a bit though, but every additional machine is another attack surface and another machine requiring hardening.

I have read the recommendations but really see nothing said about how small is very, very small. Makes me wonder why those services are even provided on the Sophos.

Guys, I just changed my post after having thought about it some more.

Doug, how does a client ask for a response without recursion?  Or, do you mean one that's not cached?

When you say "the recommendations," were you speaking of DNS best practice?

Cheers - Bob

Hey Bob. I was really talking about https://community.sophos.com/kb/en-us/120283 but that really applied to using UTM DNS in conjunction with AD DNS. I do manage one environment where we do have AD servers but I am really talking more about using UTM DNS as the only DNS server.

I don't remember which specific article or post that I read that suggested that the UTM DNS server should not be used as the only one. I know the first priority for UTM is firewall and routing but I have been running it as my sole DNS server in my PCI scope for a couple of years now and never had any issues with the service. This was done mainly as a convenience for adding new machines to the environment when first setup. Since, by default, new linux virtual machines come up with DHCP it was really easy to just go in afterwards and make them static, thus reserving their IPs, and making them resolvable to the other machines. I don't want to debate using DHCP in a PCI environment as that is really not a best practice either but I have other controls (Nessus and Splunk) that insure nothing else sneaks in.

I cant speak to what kind of DNS request was issued by my internal Pen Testers, though. They used Nessus but I don't know which scan policy they used. I did expect DNS to be recursive, though, so no surprise there.