On Sun, Feb 9, 2014 at 3:55 PM, Peter Eckel <lists@xxxxxxxxxxxx> wrote:
> Hi James,
>
> you seem to be running an open DNS resolver, is that correct? And if so,
> do you do it intentionally?
>
Nux! and Peter are almost certainly correct.
If the OP was to run tcpdump with the -A flag on the external/public-facing
interface, I'd expect he'll see a slew of ANY queries.
# untested
# but the pipe to grep should highlight the word any while still displaying
everything tcpdump's filter matches on (dns queries on port 53)
tcpdump -i <public-facing_interface> -nnA port 53 | grep --color -i -E
'any|$'
The OP likely doesn't want to be an open recursive DNS server.
He can rate-limit DNS queries per source or better yet, set up bind views
and separate ACLs ... trusted hosts in one and everyone else (external
Internet hosts) in the other. In the internal/trusted view leave recursion
enabled for those hosts (I expect that's what you want). AND most
importantly in the external view _disable_ recursion. If there's no reason
for you to answer any queries on your public facing interface, then disable
it all together (you could be running an authoritative name server on that
box, so you wouldn't want to do that!).
Tips to secure your BIND install ... brought to you by Team Cymru [0]
And while you're at it, if you're running ntpd - secure it too [1] if you
haven't already. (Essentially disable monitor/monlist command responses.)
[0] http://www.cymru.com/Documents/secure-bind-template.html
[1] http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-template.html
>
> I just received an US-CERT alert today that warns about ongoing
> amplification attacks, among others against DNS, but also against some
> other UDP based services.
>
> <https://www.us-cert.gov/ncas/alerts/TA14-017A>
>
> From the symptoms you describe I'd say that your DNS server is being used
> in such an attack.
>
> > I also see a chroot directory, but if I grep for named it doesn't appear
> > to be using the chroot(?):
> > # ps aux | grep named
> > named 3497 0.4 0.7 170088 15836 ? Ssl 23:02 0:02
> > /usr/sbin/named -u named
> > root 3763 0.0 0.0 61192 764 pts/1 S+ 23:13 0:00 grep
> named
>
> Do you have the bind-chroot package installed?
>
> Best regards,
>
> Peter.
>
>
>
> _______________________________________________
> CentOS mailing list
> CentOS@xxxxxxxxxx
> http://lists.centos.org/mailman/listinfo/centos
>
>
--
---~~.~~---
Mike
// SilverTip257 //
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
