0

We have dedicated server with centos7. For last 3 days we are receiving Abuse reports that saying 'we detected the following DoS attack with DNS related pattern.' And the source is our server. How can we fix this issue.

Thanks in Advance.

0

Sounds like you are running a DNS server which can be used for DNS amplification attacks. As you state that the server is CentOS based, check if a named/bind is active and running. In case bind is not active, use ss or netstat with -tulpen to figure out what program uses port 53.

When bind is running use bind's ACL mechanisms to limit access to your DNS server. If your DNS is authorative, consider using iptables rate limiting or fail2ban. Dealing with bind, I can highly recommend the bind administrator reference manual.

  • I have checked with netstat and the following row comes with port 53 'udp 0 0 127.0.0.1:53 0.0.0.0:* 25 2337467 8766/named ' – Johnny Jul 27 '18 at 7:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.