Re: [Pdns-users] Workaround for PowerDNS Security Advisory 2014-02

2014-12-18 Thread sthaug
> > - Is PowerDNS recursor meant to have a coherent cache? The observed > > behavior on my 3.6.2/FreeBSD 9.3 installation is that I have as many > > caches as I have threads (as configured with "threads=..." in > > recursor.conf). This is clearly visible on the TTL of the replies, > > e.g. (queryin

Re: [Pdns-users] Workaround for PowerDNS Security Advisory 2014-02

2014-12-18 Thread bert hubert
On Fri, Dec 12, 2014 at 09:23:16AM +0100, sth...@nethelp.no wrote: > > You can update auth-zones using 'rec_control reload-zones' at runtime > > without restarting the recursor, which will discover new zones to be blocked > > or no no longer blocked. > > A couple of questions regarding reload-zone

Re: [Pdns-users] Workaround for PowerDNS Security Advisory 2014-02

2014-12-12 Thread sthaug
> You can update auth-zones using 'rec_control reload-zones' at runtime > without restarting the recursor, which will discover new zones to be blocked > or no no longer blocked. A couple of questions regarding reload-zones: - Is PowerDNS recursor meant to have a coherent cache? The observed behav

Re: [Pdns-users] Workaround for PowerDNS Security Advisory 2014-02

2014-12-10 Thread Vu Le
> auth-zones is good. Even better would be 'auth-zones-from-file' with > one domain name per line. > > It would also be good to have some more discussion of the best way to > battle the latest round of .domain lookups from compromised > clients. We're currently seeing a significant number of A loo

Re: [Pdns-users] Workaround for PowerDNS Security Advisory 2014-02

2014-12-10 Thread bert hubert
Hi everybody, We're talking to many impacted PowerDNS users today. No matter what version of the PowerDNS Recursor you run, if you have any problems with ezdns/tracker.istole.it/ezrss/eztv domains today, we recommend the 'nullzoning' from below. Bert On Tue, Dec 09, 2014 at 03:31:35PM +

Re: [Pdns-users] Workaround for PowerDNS Security Advisory 2014-02

2014-12-10 Thread sthaug
> From PowerDNS users we have heard of problems caused by various domain names > related to PowerDNS Security Advisory 2014-02 (CVE-2014-8601), > http://doc.powerdns.com/md/security/powerdns-advisory-2014-02/ > > If you are not yet in a position to upgrade to 3.6.2, or even if you have > upgraded

[Pdns-users] Workaround for PowerDNS Security Advisory 2014-02

2014-12-09 Thread bert hubert
Hi everybody, >From PowerDNS users we have heard of problems caused by various domain names related to PowerDNS Security Advisory 2014-02 (CVE-2014-8601), http://doc.powerdns.com/md/security/powerdns-advisory-2014-02/ If you are not yet in a position to upgrade to 3.6.2, or even if you have upgra