<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<!-- Template generated by Exclaimer Mail Disclaimers on 04:05:02 Monday, 17 October 2011 -->
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css">P.2d8b867a-877d-4abf-9f71-702c0dd4ea36 {
MARGIN: 0cm 0cm 0pt
}
LI.2d8b867a-877d-4abf-9f71-702c0dd4ea36 {
MARGIN: 0cm 0cm 0pt
}
DIV.2d8b867a-877d-4abf-9f71-702c0dd4ea36 {
MARGIN: 0cm 0cm 0pt
}
TABLE.2d8b867a-877d-4abf-9f71-702c0dd4ea36Table {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style>
<meta name="Generator" content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="PersonName" /><!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]--><style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang="EN-US" link="blue" vlink="blue">
<p class="2d8b867a-877d-4abf-9f71-702c0dd4ea36"></p>
<div class="Section1">
<p class="MsoNormal"><font size="2" color="navy" face="Arial"><span style="font-size:
10.0pt;font-family:Arial;color:navy">I’m confused – does the OP want to block or does he want to redirect. “block/redirect” are two different things. What I wrote will
block. If he wants to redirect that’s fine but I don’t think he’d want to redirect to his real webserver – why send bogus traffic there and also take the risk that being so directed the bad user will be able to hack? Dropping the packet in DNS stops it
cold. (Not saying they can’t get to web server’s via legitimate paths but it appears the OP has know malefactors.) Is the OP building a honeypot?<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="navy" face="Arial"><span style="font-size:
10.0pt;font-family:Arial;color:navy"><o:p> </o:p></span></font></p>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><font size="3" face="Times New Roman"><span style="font-size:12.0pt"></span></font></div>
</div>
</div>
<p></p>
<p class="2d8b867a-877d-4abf-9f71-702c0dd4ea36"> </p>
<p class="2d8b867a-877d-4abf-9f71-702c0dd4ea36"> </p>
<p class="2d8b867a-877d-4abf-9f71-702c0dd4ea36"></p>
<div class="Section1">
<div>
<div class="MsoNormal" align="center" style="text-align:center"><font size="3" face="Times New Roman"><span style="font-size:12.0pt">
<hr size="2" width="100%" align="center" tabindex="-1">
</span></font></div>
<p class="MsoNormal"><b><font size="2" face="Tahoma"><span style="font-size:10.0pt;
font-family:Tahoma;font-weight:bold">From:</span></font></b><font size="2" face="Tahoma"><span style="font-size:10.0pt;font-family:Tahoma"> bind-users-bounces+jlightner=water.com@lists.isc.org
[mailto:bind-users-bounces+jlightner=water.com@lists.isc.org] <b><span style="font-weight:bold">On Behalf Of
</span></b>Ryan Novosielski<br>
<b><span style="font-weight:bold">Sent:</span></b> Monday, October 17, 2011 3:52 PM<br>
<b><span style="font-weight:bold">To:</span></b> babu dheen; Bind Users Mailing List; cet1@cam.ac.uk<br>
<b><span style="font-weight:bold">Subject:</span></b> Re: DNS Sinkhole in BIND</span></font><o:p></o:p></p>
</div>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt">I do this. There may now be a smarter way, but I have a small number so this is manageable for me: configure zones for each of the evil zones. Your server will appear
authoritative and you can direct clients wherever you like. I direct some of mine to a virtualhost handing out 503 errors.<br>
</span></font><font face="Verdana"><span style="font-family:Verdana"><br>
<br>
</span></font><o:p></o:p></p>
<span id="signature">
<div>
<p class="MsoNormal"><font size="1" color="#999999" face="Arial"><span style="font-size:8.0pt;font-family:Arial;color:#999999">-- Sent from my Palm Pre<o:p></o:p></span></font></p>
</div>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt"><br>
<br>
</span></font><font color="navy" face="Verdana"><span style="font-family:Verdana;
color:navy"></span><o:p></o:p></span></font></p>
<div class="MsoNormal"><font size="3" color="navy" face="Verdana"><span style="font-size:12.0pt;font-family:Verdana;color:navy">
<hr size="2" width="75%" align="left">
</span></font></div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><font size="3" color="navy" face="Verdana"><span style="font-size:12.0pt;font-family:Verdana;color:navy">On Oct 17, 2011 13:46, babu dheen <babudheen@yahoo.co.in> wrote:
<o:p></o:p></span></font></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<div>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:12.0pt">YOu are obsolutely correct Chris.. I want to block/redirect all malware domain request intiated by clients by setting up DNS SINKHOLE in Redhat BIND server.<o:p></o:p></span></font></p>
</div>
<div>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:12.0pt"> <o:p></o:p></span></font></p>
</div>
<div>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:12.0pt"><br>
<br>
--- On <b><span style="font-weight:bold">Mon, 17/10/11, <st1:PersonName w:st="on">
Chris Thompson</st1:PersonName> <i><span style="font-style:italic"><cet1@cam.ac.uk></span></i></span></b> wrote:<o:p></o:p></span></font></p>
</div>
<blockquote style="border:none;border-left:solid #1010FF 1.5pt;padding:0in 0in 0in 3.0pt;
margin-left:3.4pt;margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-bottom:12.0pt"><font size="3" face="Times New Roman"><span style="font-size:12.0pt"><br>
From: <st1:PersonName w:st="on">Chris Thompson</st1:PersonName> <cet1@cam.ac.uk><br>
Subject: Re: DNS Sinkhole in BIND<br>
To: "Bind Users Mailing List" <<st1:PersonName w:st="on">bind-users@lists.isc.org</st1:PersonName>><br>
Cc: "babu dheen" <babudheen@yahoo.co.in><br>
Date: Monday, 17 October, 2011, 8:19 PM<o:p></o:p></span></font></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><font size="3" face="Times New Roman"><span style="font-size:12.0pt">On Oct 16 2011, babu dheen wrote:<br>
<br>
> Can anyone help me how to setup DNS Sinkhole in BIND on Linux 32 bit edition.<br>
<br>
All the replies to this so far seem to assume that he wants to block evil<br>
entities from using his nameservers. But Google seems to suggest that<br>
"DNS Sinkhole" usually refers to redirecting names that are being used<br>
for evil purposes to e.g. a local monitoring station - not the same thing<br>
at all.<br>
<br>
-- <st1:PersonName w:st="on">Chris Thompson</st1:PersonName><br>
Email: <a href="http://in.mc1373.mail.yahoo.com/mc/compose?to=cet1@cam.ac.uk" ymailto="mailto:cet1@cam.ac.uk">
cet1@cam.ac.uk</a><br>
<br>
<o:p></o:p></span></font></p>
</div>
</blockquote>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt"><o:p> </o:p></span></font></p>
</div>
<div></div>
<p></p>
<p class="2d8b867a-877d-4abf-9f71-702c0dd4ea36"><font face="Arial"><font color="fuchsia"><font style="FONT-FAMILY: Arial; FONT-SIZE: 10pt" size="2"></font></font></font> </p>
<p class="2d8b867a-877d-4abf-9f71-702c0dd4ea36"> </p>
<p class="2d8b867a-877d-4abf-9f71-702c0dd4ea36"><font face="Arial"><font color="fuchsia"><font style="FONT-FAMILY: Arial; FONT-SIZE: 10pt" size="2">Athena<font size="1">®</font>, Created for the Cause</font><font size="1">™
</font></font></font></p>
<p class="2d8b867a-877d-4abf-9f71-702c0dd4ea36"><font size="2" face="Arial">Making a Difference in the Fight Against Breast Cancer</font></p>
<p class="2d8b867a-877d-4abf-9f71-702c0dd4ea36"><span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"></span> </p>
<p class="2d8b867a-877d-4abf-9f71-702c0dd4ea36"><span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt">---------------------------------<br>
CONFIDENTIALITY NOTICE: This e-mail may contain privileged or confidential information and is for the sole use of the intended recipient(s). If you are not the intended recipient, any disclosure, copying, distribution, or use of the contents of this information
is prohibited and may be unlawful. If you have received this electronic transmission in error, please reply immediately to the sender that you have received the message in error, and delete it. Thank you.<br>
----------------------------------</span><span style="FONT-FAMILY: 'Courier New'; FONT-SIZE: 9pt"><o:p></o:p></span></p>
<p> </p>
</body>
</html>