<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<!-- Template generated by Exclaimer Mail Disclaimers on 01:14:19 Monday, 6 October 2014 -->
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css">P.c2f1bf1c-1148-476c-b518-6d457a437bfe {
MARGIN: 0cm 0cm 0pt
}
LI.c2f1bf1c-1148-476c-b518-6d457a437bfe {
MARGIN: 0cm 0cm 0pt
}
DIV.c2f1bf1c-1148-476c-b518-6d457a437bfe {
MARGIN: 0cm 0cm 0pt
}
TABLE.c2f1bf1c-1148-476c-b518-6d457a437bfeTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style>
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<p class="c2f1bf1c-1148-476c-b518-6d457a437bfe"></p>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Have you checked the source of the majority of the IPs? In the past I was able to mitigate stuff like this by adding drop rules to iptables for ranges in
certain countries (Russia and Rumania are two I recall). Usually when I see this kind of event the majority is coming from a certain area or IP and I can address. (Interestingly the most recent event turned out to be from our internal hand helds asking
me for internal addresses via the external view and of course getting refused.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">You can and SHOULD turn off recursion from external facing interface as anyone coming to you should only be resolving the domains for which you are authoritative.
You can leave recursion on for the internal facing network but should do that only if your internal folks use your DNS servers to resolve external domains (e.g. google.com, yahoo.com etc…).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">If you’re only using a single interface (i.e. your DNS serer isn’t properly DMZ’d) you may not be able to turn off recursion in which case you should work on
putting it in a DMZ so that you can segregate traffic to it.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> ale-bounces@ale.org [mailto:ale-bounces@ale.org]
<b>On Behalf Of </b>Chuck Payne<br>
<b>Sent:</b> Monday, October 06, 2014 12:06 PM<br>
<b>To:</b> Atlanta Linux Enthusiasts - Yes! We run Linux!<br>
<b>Subject:</b> [ale] Fwd: Under Attack, my dns servers<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Guys, <o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">I am under attack where my dns server is being used to do a ddos attack. I believe it's a bot net, because the ip are too random. I don't think the domain I am seeing in my bind log is real<o:p></o:p></p>
</div>
<p class="MsoNormal">fkfkfkfz.guru <o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
06-Oct-2014 11:23:28.146 client 92.222.9.179#49643: query: fkfkfkfz.guru IN ANY +E (50.192.59.225)<br>
06-Oct-2014 11:23:28.146 client 92.222.9.179#49643: query (cache) 'fkfkfkfz.guru/ANY/IN' denied<br>
06-Oct-2014 11:23:28.146 client 92.222.9.179#49643: drop REFUSED response to <a href="http://92.222.9.0/24" target="_blank">
92.222.9.0/24</a><br>
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">I have turn on recursion, but now people can't find my domains any more. I have also try to limit the rate as well
<br>
<br>
rate-limit {<br>
responses-per-second 25;<br>
window 5;<br>
};<br>
<br>
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">I am running Debian and openSUSE.
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Anything I can do to stop them and make where people can find my domains? I don't want to have to pay for something I can do and have control over.
<br clear="all">
<o:p></o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><br>
-- <o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Terror PUP a.k.a<br>
Chuck "PUP" Payne<br>
<br>
<a href="tel:678%20636%209678" target="_blank">678 636 9678</a><br>
-----------------------------------------<br>
Discover it! Enjoy it! Share it! openSUSE Linux.<br>
-----------------------------------------<br>
openSUSE -- Terrorpup<br>
openSUSE Ambassador/openSUSE Member<br>
skype,twiiter,identica,friendfeed -- terrorpup<br>
freenode(irc) --terrorpup/lupinstein<br>
Register Linux Userid: 155363<br>
<br>
Have you tried SUSE Studio? Need to create a Live CD, an app you want to package and distribute , or create your own linux distro. Give SUSE Studio a try.<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<br>
-- <o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Terror PUP a.k.a<br>
Chuck "PUP" Payne<br>
<br>
678 636 9678<br>
-----------------------------------------<br>
Discover it! Enjoy it! Share it! openSUSE Linux.<br>
-----------------------------------------<br>
openSUSE -- Terrorpup<br>
openSUSE Ambassador/openSUSE Member<br>
skype,twiiter,identica,friendfeed -- terrorpup<br>
freenode(irc) --terrorpup/lupinstein<br>
Register Linux Userid: 155363<br>
<br>
Have you tried SUSE Studio? Need to create a Live CD, an app you want to package and distribute , or create your own linux distro. Give SUSE Studio a try.<o:p></o:p></p>
</div>
</div>
</div>
<p></p>
<p class="c2f1bf1c-1148-476c-b518-6d457a437bfe"> </p>
<p class="c2f1bf1c-1148-476c-b518-6d457a437bfe"></p>
<p class="c2f1bf1c-1148-476c-b518-6d457a437bfe"><font face="Arial"><font color="fuchsia"><font style="FONT-FAMILY: Arial; FONT-SIZE: 10pt" size="2">Athena<font size="1">®</font>, Created for the Cause</font><font size="1">™
</font></font></font></p>
<p class="c2f1bf1c-1148-476c-b518-6d457a437bfe"><font size="2" face="Arial">Making a Difference in the Fight Against Breast Cancer</font></p>
<p class="c2f1bf1c-1148-476c-b518-6d457a437bfe"><font size="2" face="Arial">_________________________________________________________</font></p>
<p class="c2f1bf1c-1148-476c-b518-6d457a437bfe"><span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><font color="#7d7d7d">CONFIDENTIALITY NOTICE: This e-mail may contain privileged</font></span></p>
<p class="c2f1bf1c-1148-476c-b518-6d457a437bfe"><span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><font color="#7d7d7d">or confidential information and is for the sole use of the intended</font></span></p>
<p class="c2f1bf1c-1148-476c-b518-6d457a437bfe"><span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><font color="#7d7d7d">recipient(s). If you are not the intended recipient, any disclosure,</font></span></p>
<p class="c2f1bf1c-1148-476c-b518-6d457a437bfe"><span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><font color="#7d7d7d">copying, distribution, or use of the contents of this information</font></span></p>
<p class="c2f1bf1c-1148-476c-b518-6d457a437bfe"><span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><font color="#7d7d7d">is prohibited and may be unlawful. If you have received this
</font></span><span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><font color="#7d7d7d">electronic</font></span></p>
<p class="c2f1bf1c-1148-476c-b518-6d457a437bfe"><span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><font color="#7d7d7d">transmission in error, please reply immediately to
</font></span><span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><font color="#7d7d7d">the sender that</font></span></p>
<p class="c2f1bf1c-1148-476c-b518-6d457a437bfe"><span style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><font color="#7d7d7d">you have received the message in error, and delete it. Thank you.<br>
</p>
</font></span>
<p></p>
<p></p>
<p></p>
</body>
</html>