我在EC2上运行一个DNS服务器,昨天当我查看了我的计费仪表板,并且在本月发现了1.86 TB的使用数据时,它正在运行一个20Mbps的服务器。 这对我的小型项目实验室来说是一个很大的开支。 我从来没有注意到性能下降,也没有打扰之前build立交通门槛,但现在我已经花了我$ 200 +带宽收费。
似乎有人使用我的DNS服务器作为放大攻击的一部分,但是我对此感到茫然。
configuration如下。
// BBB.BBB.BBB.BBB = ns2.mydomain.com ip address options { listen-on port 53 { any; }; // listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-transfer { BBB.BBB.BBB.BBB; }; allow-query-cache { BBB.BBB.BBB.BBB; }; allow-query { any; }; allow-recursion { none; }; empty-zones-enable no; forwarders { 8.8.8.8; 8.8.4.4; }; fetch-glue no; recursion no; dnssec-enable yes; dnssec-validation yes; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; zone "mydomain.com" IN { type master; file "zones/mydomain.com"; allow-transfer { BBB.BBB.BBB.BBB; localhost; }; };
鉴于这种configuration,我不应该回答区域的任何查询我不本地托pipe吗? 这个服务器是几个域的SOA,但不习惯我的其他服务器查看任何东西(每个人都针对OpenDNS或Google进行parsing)。 我在这里有什么指令,或者我忘了? 我的日志(63MB +)是这样的:
client 58.215.173.155#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 58.215.173.155#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 58.215.173.155#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 58.215.173.155#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 58.215.173.155#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 58.215.173.155#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 218.93.206.228#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 218.93.206.228#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 218.93.206.228#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 218.93.206.228#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 218.93.206.228#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 218.93.206.228#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 50.19.220.154#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 50.19.220.154#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 50.19.220.154#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 50.19.220.154#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 50.19.220.154#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 50.19.220.154#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 123.207.161.124#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 123.207.161.124#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 123.207.161.124#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 123.207.161.124#4444: query (cache) 'cpsc.gov/ANY/IN' denied client 123.207.161.124#4444: query (cache) 'cpsc.gov/ANY/IN' denied
即使您的服务器设置为只响应您的权威查询,仍可能用于放大攻击 – ANY
针对区域根目录的查询都可能触发相当大的UDP响应,因为区域根目录倾向于有一些logging,特别是SPF / DKIM / DNSSEC。
这可能是你的系统上发生了什么 – 使用tcpdump
来确认。 如果他们在放大攻击中使用你的权威logging,你最好的select将是简单地移动到一个新的IP,并希望他们不遵循,改变你的区域根logging,使其成为一个不太有效的放大向量,或实现响应速率限制(如果您的BIND支持)。