Linux Server DNS Security Checklist: From resolv.conf Permissions to Zone Transfer Configuration

To secure DNS on Linux servers, basic configurations must be checked on both the client and server sides. A DNS client is built into the OS network stack or web browsers, and performs the function of resolving domain names and IP addresses to each other.

The key to client-side security is maintaining the integrity of the resolv.conf and hosts files. Since these files are used for system-wide DNS management and local host configuration, their owner and permissions must be checked to prevent malicious tampering. In particular, if resolv.conf is linked via a symbolic link, the permissions of the actual target file must also be checked.

Building a DNS Server and Responding to Vulnerabilities

Recently, the use of public DNS services such as AWS Route 53 or Cloudflare has been increasing, but for special purposes such as network segregation, BIND, PowerDNS, etc. are built directly. Since DNS servers have a file-based database structure, they can be exposed to vulnerabilities such as Buffer Overflow or DoS, making regular patching and monitoring essential.

Zone Transfer Security Configuration

DNS Zone Transfer is a function that synchronizes data between master and slave servers, and since it includes host and network configuration information, security is important. To prevent unauthorized access, only allowed IPs should be specified via the allow-transfer option, or it should be disabled.

Based on BIND 9.18, an example configuration is as follows:

• Primary server: Explicitly specify allowed IPs in the allow-transfer option, either globally or per zone.
• Secondary server: Specify the Primary server IP via the primaries option, and restrict allow-transfer.

In addition, enabling DNSSEC and using a trusted DNS filtering service are recommended to prevent data forgery. Unnecessary external access should be blocked by applying the latest security patches and configuring access control lists (ACLs).