<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Dear PDNS list,<br>
<br>
i need some advice on an issue that we've been experiencing on our
public DNS servers the last days.<br>
we have been, and still are currently the victims of a terrible DNS
DOS amplification attack.<br>
<br>
im not sure how many others out there are experiencing this issue,
but im hoping that someone out there<br>
may have useful PDNS tips that can be used as a counter-measure.
(i've attached a few lines below from the log files, <br>
to give you an idea of what is going on). i am currently using PDNS
AS 2.9.21.2-1 on debian 5 x86.<br>
<br>
May 28 15:01:13 ns1 pdns[9603]: Not authoritative for '<a
href="http://filezilla.de" target="_blank">filezilla.de</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:18 ns1 pdns[9603]: Not authoritative for '<a
href="http://filezilla.de" target="_blank">filezilla.de</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:18 ns1 pdns[9603]: Not authoritative for '<a
href="http://filezilla.de" target="_blank">filezilla.de</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:18 ns1 pdns[9603]: Not authoritative for '<a
href="http://blogylana.com" target="_blank">blogylana.com</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:19 ns1 pdns[9603]: Not authoritative for '<a
href="http://blogylana.com" target="_blank">blogylana.com</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:20 ns1 pdns[9603]: Not authoritative for '<a
href="http://blogylana.com" target="_blank">blogylana.com</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:23 ns1 pdns[9603]: Not authoritative for '<a
href="http://filezilla.de" target="_blank">filezilla.de</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:25 ns1 pdns[9603]: Not authoritative for '<a
href="http://filezilla.de" target="_blank">filezilla.de</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:25 ns1 pdns[9603]: Not authoritative for '<a
href="http://blogylana.com" target="_blank">blogylana.com</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:26 ns1 pdns[9603]: Not authoritative for '<a
href="http://filezilla.de" target="_blank">filezilla.de</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:28 ns1 pdns[9603]: Not authoritative for '<a
href="http://filezilla.de" target="_blank">filezilla.de</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:30 ns1 pdns[9603]: Not authoritative for '<a
href="http://blogylana.com" target="_blank">blogylana.com</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:33 ns1 pdns[9603]: Not authoritative for '<a
href="http://blogylana.com" target="_blank">blogylana.com</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:33 ns1 pdns[9603]: Not authoritative for '<a
href="http://filezilla.de" target="_blank">filezilla.de</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:34 ns1 pdns[9603]: Not authoritative for '<a
href="http://blogylana.com" target="_blank">blogylana.com</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:38 ns1 pdns[9603]: Not authoritative for '<a
href="http://blogylana.com" target="_blank">blogylana.com</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:39 ns1 pdns[9603]: Not authoritative for '<a
href="http://filezilla.de" target="_blank">filezilla.de</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:41 ns1 pdns[9603]: Not authoritative for '<a
href="http://filezilla.de" target="_blank">filezilla.de</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:41 ns1 pdns[9603]: Not authoritative for '<a
href="http://blogylana.com" target="_blank">blogylana.com</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
May 28 15:01:43 ns1 pdns[9603]: Not authoritative for '<a
href="http://blogylana.com" target="_blank">blogylana.com</a>',
sending servfail to 184.22.170.194 (recursion was desired)<br>
<br>
our DNS server is setup as an authoritative server for the zones we
host (via bind backend)...and i can confirm that all recursion has <br>
been disabled on this authoritative server.<br>
<br>
so far i have done the following:<br>
<br>
- cache-ttl is set to 0<br>
- distributor-threads set to 1<br>
- max-tcp-connections set to 60<br>
- negquery-cache-ttl set to 0<br>
- setup IPtables with a chain to reject udp/tcp connections to port
53 if they create more than 7 connections per second<br>
<br>
(most of the cache settings were disabled anyway, as it messes with
a highly modified geo backend that i use)<br>
<br>
the firewall has helped alot... and our ourstream ISP has started
throttling traffic to our nameservers.. which has also helped<br>
at the cost of some dropped legit requests. <br>
<br>
apon discussion with one of the ISP's which we sent an abuse report
for one of their IP's, they seem to think they these IP address <br>
have all been spoofed for this amplification attack.<br>
<br>
any advice/criticism/tips would be appreciated<br>
<br>
thanks<br>
<br>
kalpesh<br>
<br>
<br>
<br>
</body>
</html>