La Salle Debain

On Monday, I was informed that my server (a xen instance hosted at Brainfood was chewing up a lot of bandwidth by giving out long DNS responses at the rate of several per second. According to Peter Palfrader, it was most likely due to this DoS attack.

Apparently I was contributing to the problem because my name server (running bind9 ) was accepting queries from anywhere on the Internet. You can test this via an online tool from SANS or by issuing the following command from a machine which is not on your network.

dig -t ns @your.name.server

If the status that comes back is NOERROR, you have a problem.

The fix is to restrict the IPs you allow queries from by adding the allow-query directive to your bind configuration. If you are using the stock Debian setup, add it in the options stanza in /etc/bind/named.conf.options

Because all my services run on one machine, I did it like this:

allow-query { localhost; };

If yours are spread out over several hosts, you need to add all their IPs.

If you are authoritative for any zones, you want to allow queries from anywhere so add

allow-query { any; };

to the stanza for each zone. In a stock Debian setup, these are in /etc/bind/named.conf.local

Once you have done this and restarted bind, go back to the online tool or run dig again. If status is REFUSED, congratulations you have saved the Internet.