[CentOS] BInd Problem or Update SSL ?

[Larry Vaden]

On Fri, Feb 18, 2011 at 4:37 PM, James Hogarth <james.hogarth at gmail.com> wrote:
>
> Your mentor? What do you mean by that?

The same thing Wikipedia says, namely:

a trusted friend, counselor or teacher, usually a more experienced
person. Some professions have "mentoring programs" in which newcomers
are paired with more experienced people, who advise them and serve as
examples as they advance.

Joe, Randy and James are my mentors of 15, 5 and 5 years,
respectively, and all said the same thing, namely "nuke and repave, be
sure to be current on BIND" since it is a purpose-built box (ns1).

Since others have asked for details, they are below the sig.

With 20/20 hindsight, it is clear that I shouldn't have posted the
original post asking the list for help and hopefully informing other
potential targets of the risk (read: there were no responses to the
original post, therefore it was posted to the wrong audience).

regards/ldv/vaden at texoma.net

There was no time for forensics at the time of the discovery; just
time to get advice and react.
What follows is from a few moments ago.

===details===
===box was last nuked and repaved Jul 28  2008
===much unnecessary software removed Jul 28 2008, 57 tasks active per
'ps auxw | wc -l'
===current nmap (same nmap results as on problem day)
Starting Nmap 5.21 ( http://nmap.org ) at 2011-02-18 18:38 CST
Note: Host seems down. If it is really up, but blocking our ping probes, try -PN
Nmap done: 1 IP address (0 hosts up) scanned in 0.19 seconds
vaden at turtlehill:/opt$ nmap -A -PN ns1.texoma.net
Starting Nmap 5.21 ( http://nmap.org ) at 2011-02-18 18:38 CST
Nmap scan report for ns1.texoma.net (209.151.96.2)
Host is up (0.0012s latency).
Not shown: 998 filtered ports
PORT    STATE SERVICE VERSION
53/tcp  open  domain
987/tcp open  ssh     OpenSSH 3.9p1 (protocol 2.0)
| ssh-hostkey: 1024 36:dc:c8:29:b1:d3:8a:b1:e6:cf:2b:4c:70:ed:c8:9a (DSA)
|_1024 10:f9:a6:d2:32:68:15:3a:9f:04:3a:89:05:1e:b8:52 (RSA)
Service detection performed. Please report any incorrect results at
http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 26.44 seconds
vaden at turtlehill:/opt$
===named.conf security in 2008
[root at ns1 data]# cat /var/named/chroot/etc/named.conf | more
###
#
#  attribution: By Rob Thomas, noc at cymru.com
#               <http://www.cymru.com/Documents/secure-bind-template.html>
#  -and-
#
<http://www.knowplace.org/pages/howtos/split_view_with_bind_9_howto.php>
#
#  at the behest of
#  Dr. Joe Redacted (redacted1.edu)
#  Dr. Randall Redacted (redacted2.edu)
===
ssh port not on 22
===
distro's standard iptables save ssh port