From owner-freebsd-questions@FreeBSD.ORG Sun Feb 15 04:41:26 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2D0AA16A4CE for ; Sun, 15 Feb 2004 04:41:26 -0800 (PST) Received: from smtp.infracaninophile.co.uk (happy-idiot-talk.infracaninophile.co.uk [81.2.69.218]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6A1C243D1D for ; Sun, 15 Feb 2004 04:41:25 -0800 (PST) (envelope-from m.seaman@infracaninophile.co.uk) Received: from happy-idiot-talk.infracaninophile.co.uk (localhost [IPv6:::1]) i1FCfFKw009950 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 15 Feb 2004 12:41:15 GMT (envelope-from matthew@happy-idiot-talk.infracaninophile.co.uk) Received: (from matthew@localhost)id i1FCfES6009949; Sun, 15 Feb 2004 12:41:14 GMT (envelope-from matthew) Date: Sun, 15 Feb 2004 12:41:14 +0000 From: Matthew Seaman To: fbsdq Message-ID: <20040215124114.GA9482@happy-idiot-talk.infracaninophile.co.uk> Mail-Followup-To: Matthew Seaman , fbsdq , freebsd-questions@freebsd.org References: <200402150403.i1F43E9s003486@saexchange.toneisp.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="jRHKVT23PllUwdXP" Content-Disposition: inline In-Reply-To: <200402150403.i1F43E9s003486@saexchange.toneisp.com> User-Agent: Mutt/1.5.6i X-Spam-Status: No, hits=-4.9 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=2.63 X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on happy-idiot-talk.infracaninophile.co.uk cc: freebsd-questions@freebsd.org Subject: Re: 3,000+ DNS /./ANY/ANY requests - ...resent... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Feb 2004 12:41:26 -0000 --jRHKVT23PllUwdXP Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Feb 14, 2004 at 09:03:14PM -0700, fbsdq wrote: > Sorry about the earlier question, that was more or less just blank....=20 >=20 > Hello, > About a week ago I started noticing 3,000 or more requests coming from = =20 > several ips for the following DNS queries: > XX+/128.255.203.200/./ANY/ANY > XX+/193.201.105.4/./ANY/ANY=20 >=20 > Those are just two examples, but each IP - I have about 20 of them now= =20 > create 3,000 or more queries within several minutes. All the queries are= =20 > exactly the same for ./ANY/ANY.....any idea what those queries are? or wh= at=20 > they are trying to do? Curious. Are those IPs taken literally from your log files? One of them belongs to the University of Iowa and the other to belongs to Millenium Communications S.A. in Poland. Seems that some arbitrary collection of machines are trying to do arbitrary lookups on your DNS servers. Have you configured your nameservers so that they will refuse to do recursive queries for strangers? There's various cache poisoning tricks that can be done if your DNS server is both recursive and authoritative for your own domains. There's some good pages about how to secure various versions of BIND at http://www.boran.com/security/sp/bind_hardening8.html http://www.boran.com/security/sp/bind9_20010430.html Those are aimed mainly as Solaris users, so there's whole sections about how to compile which you can just skip over. The 'take home' point is how to use the 'allow-query', 'allow-transfer' and 'allow-recursion' configuration directives correctly. > Also how can I create an 'ipfw' rule to block an ip if XX amount of=20 > connections come in within XX amount of minutes/seconds?? Right now I=20 > manually block them, and yes those IP's try a day or so later to DNS bomb= =20 > (?) my machine.=20 I think my approach to this would be to write a script that trawls through /var/log/security or your DNS server logs picking out the malefactors and then writes and inserts appropriate IPFW rules -- probably on an hourly basis. Clever use of ipfw's 'set N' syntax will make administering mixing in these machine generated rules together with your other rules much easier. Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK --jRHKVT23PllUwdXP Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD4DBQFAL2jqdtESqEQa7a0RAiqhAJ96F+9uzrEFOwdxj9To0oDvwQFU4wCWIJIJ vkY+NbXp/n0mIKj3K8XdHA== =fugD -----END PGP SIGNATURE----- --jRHKVT23PllUwdXP--