I've been conducting security scans, and a new one popped up for me:

DNS Server Spoofed Request Amplification DDoS 

The remote DNS server answers to any request. It is possible to query the name servers (NS) of the root zone ('.') and get an answer which is bigger than the original request. By spoofing the source IP address, a remote attacker can leverage this 'amplification' to launch a denial of service attack against a third-party host using the remote DNS server.

General Solution: Restrict access to your DNS server from public network or reconfigure it to reject such queries.

I'm hosting my own DNS for my website. I'm not sure what the solution is here... I'm really looking for some concrete detailed steps to patch this, but haven't found any yet. Any ideas?

CentOS5 with WHM and CPanel.

Also see: http://securitytnt.com/dns-amplification-attack/

  • Your concern is your servers being used as an amplifier for such attack, or about being target of such attack ? – Sandman4 Nov 10 '11 at 18:11

If the name server is only authoritative (i.e. it's not also providing recursive service for your network), simply remove the "root hints" section from /etc/named.conf.

This typically looks something like this:

zone "." IN {
        type hint;
        file "named.ca";

Authoritative servers don't need this zone.

Doing this should result in the server returning REFUSED rather than a copy of the root name servers to external clients.

Also, as your server is authoritative only you should add:

recursion no; 

in the main configuration block.

  • We are athoritative (people can find US) - but I am not sure about recursive... is recursive for finding other servers? If so, we are definitely NOT using it in this manor.... Also, can i comment out this hints section? Will this instantly take action or will I need to restart some server somehow? – Shackrock Nov 10 '11 at 17:37
  • @Shackrock yes, recursive is if you use the server for looking up other peoples' domain names. Just comment it out, but you will then need to restart the server. – Alnitak Nov 10 '11 at 18:00
  • @Alex It's very common for DNS servers to respond to queries for the root hints, and at 512 bytes long for a ~17 byte query (plus UDP and IP headers) that can create a large amplification factor. The warning is correct and it doesn't just apply to the root servers themselves. – Alnitak Nov 10 '11 at 18:03
  • @Alnitak yeah, my mistake, I already deleted that – Sandman4 Nov 10 '11 at 18:09
  • @alnitak what do you think about Alex's answer above? Thanks Alex also. – Shackrock Nov 12 '11 at 17:46

To prevent your system from being used as an "amplifier" for such an attack, you need to disable answers to all queries except your authoritative zones. To do so in bind9, you need two directives in named.conf:

allow-recursion {none;};
allow-query-cache {none;};

Removing root hints zone from named.conf does not help, because there is a built-in hint zone which used if you don't include it explicitly in named.conf.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.