Chaos class check
Prerequisites:
None.
Package:
Integrity.
Executed on:
All nameserver IP addresses.
Check interval:
Every 5 minutes.
Impact on Availability:
None.
Impact on Integrity:
None.
Purpose
Chaos class (CH) queries can leak information about DNS server unless properly configured.
The chaos class was used in the Chaosnet, a historical network implementation that didn’t survive the Internet (IN class). However, some implementations are still in use (or misuse might be a better word) in the Chaos class and can be found in a variety of DNS software.
This check looks for the following names in the Chaos class, which are known to leak information that you might want to keep to yourself:
version.bind
Left default, this query displays the software name and its current version and in some cases the operating system.
hostname.bind
Left default , this query displays the configured hostname of the server.
id.server
Left default , this query displays the configured hostname of the server.
version.bind
It is always a good security practice to avoid information leaks of any kind. Left unchanged the default configuration of many DNS software will share software and version information, possibly even operating system versions. This feature is helpful for administrators to quickly retrieve information about DNS servers but this information should not be shared with the world. Just look at it as a remnant of a time when trust wasn’t an issue… Consult the software configuration guide if and how to disable these features.
hostname.bind and id.server
The chaos class is often utilised in anycast DNS networks to be able to identify which of the servers actually provided the query response. Unless you operate an anycast DNS network, our recommendation is to disable this information leakage if possible. Consult the software configuration guide if and how to disable these features.
Event severities and messages
INFO
An empty answer is a good answer!
Version query timed out.
Good, but not as good as an empty response since dropping these packets will result in unnecessary retransmissions.
FORMERROR/REFUSED/NOTAUTH query response.
The response is acceptable.
WARNING
Depending on the response string, this DNS may leak information.
UNKNOWN
Unable to perform check due to input data failure.
If this message appears, usually one of the queries leading up to the final query have received an empty or garbled query response. Please report this through the normal support channel.
Corrupt or malformed response from nameserver.
The check received a query response with unreadable data fields. Please report this through the normal support channel.
Unexpected response from server: {response code}
The DNS responded with an error code. The error code will most likely contain information about the reason for the error.
Solutions, tips & tricks
Most DNS vendors, regardless if opens source or commercial, usually have options to disable the Chaos class information. Some of them might have opted out of implementing the feature.