Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
Is it possible, to set up BIND as DNS server on my local network, and make execute scripts when it gets a lookup?
I would like to execute a Python or Bash script, based on the incoming DNS lookup, how can I solve this?
If possible in Bind, please tell me how, and if not, tell me if it is possible in other DNS server implementations, that run on Ubuntu.
Thank you very much.
I can think of two additional options that don't require parsing BIND logs or interfering with BIND at all.
1) Port mirroring - duplicate packets and send them to a separate port where an application is listening, parsing the DNS requests, and taking action. dpkt or scapy or similiar packet crafting libraries will help you parse the raw requests.
2) Use some type of packet sniffing library to passively monitor the requests. Here is an example using scapy:
from scapy.all import *
def handler(req):
if req.haslayer(DNS) and req.getlayer(DNS).qr == 0:
ip = req.getlayer(IP)
dns = req.getlayer(DNS)
q = dns.qd
print q.qname # simply print domain name
if __name__ == '__main__':
sniff(iface="eth0", filter="udp and port 53", prn=handler, store=0)
Obviously, this is just a primitive example. It only prints the name of the domain that was queried, but you can of course add a great deal of logic. If you reference scapy documentation you'll find that all the fields from the DNS request are readily available.
You could do so by monitoring the bind-server log (query logging has to be turned on). Good luck...
/dev/shm, too.
swatch or OSSEC on the logs to call your script. not a very good idea in the long run, either way.
No such things as events are implemented in bind, it doesn't need that.
You could look around applicative firewalls, who are used in some organizations to restrict access to some users. There you would have more chances of achieving what you want.
Setting up routes seems a good idea too, in the end what you want to achieve with bind and triggered script execution will be inefficient as well: you have to:
for each dest IP
look up through your database
if match set the route
then the OS will see and use the root
Setting up loads of routes isn't a problem and won't affect performance in a noticeable way. How many routes do you think corporate routers have? hundreds? not quite... And they don't necessarily have a fancy hardware configuration. Seriously, you are fine, serious operating systems are specifically designed to handle many routes and optimize the look up.
Besides what you wanted to do in the first place is using a database on top of the routing table, which would be another kind of database. Keep it simple. On BGP servers, many routes are actually selected/prefered for political/financial reasons, each ISP/organization can do that and they all add specific routes for this purpose. The cost of transit or a court order is often the cause of such measures.
