I have a windows 2008 server, which run a dns server for webs sites run on this server. I have report that our server used for an DNS Amplification Attack. in logs I see many queries bout isc.org. How can setup my windows dns server to only response to query about local sites? I remove all root hints, and forwards, but still it received and response to query about isc.org
OK - first things first: Either firewall your server so people outside your organization can't access it, or disable recursion:
- Open DNS Manager.
- In the console tree, right-click the applicable DNS server, then click Properties.
- Click the Advanced tab.
- In Server options, select the Disable recursion check box, and then click OK.
(Chris posted a handy picture of the page and the option you want to enable)
Do this now.
Now that you are no longer actively breaking the internet you can read about DNS amplification attacks, how they happen, why they're bad, and some of the things you can do to prevent being a pawn in them.
You may also want to read this Technet article about DNSSEC and DNS Amplification attacks which includes some informative references.
You can then determine how best to prevent your server from being used in such attacks.
Typically you will do this by only answering recursive queries for a known group of hosts (your internal machines), but other options exist as well.
- Open the DNS Manager console.
- Right click the server, select Properties.
- Advanced tab.
- Disable Recursion.
Disabling recursion may not stop attacks on public servers.
The problem is that the query is around 94 bytes and the response (stating it is an NXDOMAIN) is a minimum of 119 bytes so the attack is slightly amplified and almost always coming from a spoofed ip.
You must also have the dot zone (.) with no records in it in order to get the repsponse down to 119 bytes.
The most common of these attacks will ask for freeinfosys.com
None of the above stops the attack itself, but will reduce it's affect.
When the dns server is a public authoritative server, it needs to allow queries from anyone and any where for the zones it carries so you can not limit by p and other steps you can use for private or internal dns servers.
The next version of dns from Microsoft that ships with 2016 will have RRL which will help greatly, too bad they didn't release this much needed functionality that Bind has had for years.
When you run an authoritative dns server and jerkwad script kiddies or those wanting to cause your dns server additional traffic can and WILL send queries to your dns server (from spoofed ips) for domains that your server is NOT authoritative for.
If the dot (.) zone does not exist, even with recursion turned off the server will try and answer that query.
Only until you create the dot zone can you reduce the response to what I stated 119 bytes. And if I recall, any time you start filling the dot zone with any records other than the SOA, the response packets grow larger.
Now if you have a live example and have proof that doing something else will stop this kind of attack 100%, I am all ears and would truly love to see another answer.
I have studied this for quite a while, and have tried many things, and based upon my research, what I detailed above seems to be the best way to reduce the outgoing response as much as possible.
If you have not done so, read up on the domain I listed about along with dns attacks as it is the single most requested domain name in this kind of attack.
Granted, it is often associated with an attack on a recursive server, but these kinds of attacks DO take place on authoritative servers with recursion disabled.
I have servers running that have the root hints cleared, with recursion off, and have spent a great deal of time studying the packets with wireshark during these kinds of attacks and not once have I even seen response like you detailed. (I admit I know just enough about wireshark to make me slightly dangerous)
Do you have or know of a live demo or lab where I could see this in action? Do you happen to know what the size of that response would be since any reduction in packet size would be an improvement?
What other dns server software responds with does NOT answer Microsoft DNS Server questions as the original question was about Server 2008.
By the way, there is also the query block list, but that also does NOT refuse query's for domain in the list.
Interestingly enough since I was currently experiencing this kind of attack I tried AGAIN what one of the suggestions was.
I removed the . root zone and got a warning about needing to add root hints but ignored it.
I stopped and restarted the dns services and made sure the root hints were still clear.
The response packets went from 119 bytes to over 700 bytes so now I was apmplifying the attack by a factor of 10.
So if someone throws a meg at me I am sending out 10X the bandwith for queries I am not authoritative for to an ip that did not send the request.
I do wish that the suggestion would have worked and I was sure I had tried that before but did so once again since I just happened to have a live attack situation to try it.