On Oct 18, 2011 12:14 PM, "Norman Rieß" <nor...@smash-net.org> wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 10/17/11 20:06, Pandu Poluan wrote: > > > > On Oct 17, 2011 6:44 PM, "Norman Rieß" <nor...@smash-net.org > > <mailto:nor...@smash-net.org>> wrote: > >> > >> > >> Hello, > >> > >> sorry to interrupt this thread, but this probably means, you did not > >> perform any kernel updates on that machine for over two years and > >> therefore the system is vulnarable to some kernel bugs which where > >> discovered during this time. On a DNS machine a privilege escalation bug > >> is even more severe. I strongly recommend to secure this machine. > > > > That depends on what Kai meant with "uptime". Maybe he meant the VMs > > (he's using Xen, after all) never needs a restart, but the BIND service > > still gets regular update and the consequent service-restart. > > > > Every Xen VM is running its own kernel and needs to be restarted or > kexec'ed when this kernel is updated. If this is not the case, the VM is > vulnerable to kernel bugs just as any other physical system, even if the > host on which the VM is running is secure. > I assume BIND is updated and restarted as needed, but that is not enough.
Does it matter if the DNS server is behind a firewall that allows only TCP+UDP traffic to port 53? Rgds,
