Preventing DDOS aplification open resolver attack

DDOS Attack  by open DNS resolver:

Open dns resolver provides name resolution to any network outside your network. This means any one can use your
server to resolve the host name and also use it to attack other server by spoofing as your server. This in return
consume your server bandwidth and also cpu + memory resources making your server slow or even result to crash.
(settings suggested below is for BIND server)

Disable open recursive requests:

If we dont need open recursive on our system then we can completly disable it by following method.

vi /etc/named.conf
recursion no; // turn off recursion
allow-transfer {none;};
allow-query-cache {none;};

after modifing the named.conf file DNS server must be restarted.

service named restart

If we need to enable dns recursion then we can specify the ips, so that only these ips can do recursions.

acl ourips {
192.168.0.0/24; // change ip as required
localhost;
};
options {
allow-recursion {ourips;};
allow-query-cache{ourips;};
allow-query{any;}; // for web servers
recursion yes;
...
}

after midifing the named.conf restart the bind server

service named restart

To check whether recursion is turn off run the following command:

host google.com <your name server>
and result will be 
Host google.com not found

If you are getting too much request to your named server, you will get big log file with entry of dined request. This
will slow down the server, so to disable failed request to be written to the log
add “category security {null;}; to named file.

vi /etc/named.conf
logging {
category security {null;};
channel default_debug {
......
};
 
 

Was this answer helpful?

 Print this Article

Also Read

How to prevent DDoS attack with csf?

First make sure DDOS attack is not from open recursive DNS settings. To check and fix that issue...

How to Install Anti DDOS on Server

You can secure your server just by using this 4 Lines codes: First download install package...

Installing and configuring Spamassassin on CentOS

If you run your own mail server you'll want it to run spam filtering software to reduce the...

How to disable ping request?

If you are looking for the  steps to disable ping. Please find the steps below. Run the...

what is eXploit Scanner (cxs)

eXploit Scanner (cxs) is a new tool from Configserver that performs active scanning of files as...