DNS (53) on Linux Machine

[shagroon]

Hello everyone,

I need your help & opinion on this matter plz
I use Linux Mandrake 8.0 on my PC, & I use Internet sharing option offered by mandrake, & now I have 3 PC's connected to my host, sharing my cable connection.
My host PC is firewalled & my security setting is yMedium', so all my ports are 'stealthed or shielded, except for port 53 (DNS)
When I scan my machine Port 53 is wide open!

I'm not running any servers at all. & I have nothing running on that PC, I use it 2 learn Linux only, but primarily to act as a NAT machine or router like system.
& also to shield my other PC's from the net.

Is there is any danger Cuz my DNS port is visible?
I used 2 have Zone Alarm for windows on that PC, where I used to get lots of DNS probes, but now since I'm using Linux, I don't know for sure if this will hurt me.

Plz tell me what do ya think? & What I can do 2 correct this problem is any?

Your help is kindly appreciated.

[Stef]

Run netstat as root and use the -p option to view the PID and process name that is bound to the domain service.

Ex:

NodeFilter:~# netstat -a -A inet -p | grep domain
tcp 0 0 NodeFilter.:domain *:* LISTEN 235/named

This output lists the protocol, host and state of the specified service. It also shows the PID and process name that is bound to TCP port 53.

If you are running BIND as a DNS server or running another lightweight resolver daemon of somekind it will show up with netstat.

You'll need to configure the daemon to listen for queries only on your localhost and ethernet. You'll also need to configure the daemon to use your ISP's nameservers as forwarders (or simply use the master servers) and secure all outgoing (over the internet) DNS queries with a simple IPTables script.

Stef