Translated from 日本語 • View original Good morning. This is Infra Miyashita.
In the era of big data, various data and graphs are overflowing. This is a story about such graphs.
Introduction
I would like to use the actual graph used in infrastructure operation to see what is happening and what kind of measures need to be taken.
Graphs to Use
This is a graph that takes the query statistics of bind in munin. The OS will be CentOS release 5.9.
Problems
The colors of the graph are classified by query type, but the most common one is ANY record before 8 AM. This is a sign of a "DNS AMP attack".
Detection and Countermeasure Technology for DoS/DDoS Attacks by ISPs Explanation of DNS Amp Attacks and Setting BIND DNS to Avoid Being a Stepping Stone
Countermeasures
This time, I was exposed to an attack because I was using Bind that I did not take measures for. The worst thing about DNS AMP attacks is that they use traffic to attack others without permission, so even if they have no ill intentions, they become the perpetrators. Countermeasures are already available, but it is common to upgrade the bind version and not perform recursive queries, or to limit the NW that accepts queries. Also, if you are a CentOS 6 system, you can stop queries for specific domains with iptables. (CentOS 6 or higher is possible)
Supports ANY? . Continuous requests to the NS server DNS attacks and iptables filters
I think the most common ANY request is "isc.org". If anything, it feels like it will come slowly over a long period of time. Other than that, "uspsoig.gov", "defcon.org", and "doleta.gov" are often seen these days.
As for the method of blocking with iptables mentioned earlier, there is information such as DNS Amplification Attacks Observer and other information available, so please try to implement it to the extent that it does not affect the service.
One thing to note is that qmail pulls an ANY record to resolve the name when sending and receiving emails, so if ANY repels anything, it will be an email failure. qmail and DNSSEC <a http://mediakisslab.net/doku.php?id="linux:qmail:memo"" target="_blank">DNSSEC support
Finally
In the past, I think there are cases where you set up your own DNS server and leave it as it is and it is still running. (Rather, I feel that the DNS used by external services is properly managed by someone in charge and is operating soundly.) I'm afraid of an open resolver DNS that can't be touched in a gray environment. (In the past, illegal relay of e-mails was more flowery...)