Re: Question about DNS blackhole'ing

On Wed, Feb 18, 2009 at 4:58 AM, Mfoxx
<[email protected]> wrote:
> OK, I have a question, it's not exactly specific to DLZ usage (although a
> solution may come from the fact that I have DLZ installed).
>
> I've got a BIND 9.4 server with DLZ (mysql) running on my server, and
> everything is great. This runs on a debian etch server, so I just have the
> debian packages installed.
>
> However, about once a week or so, my DNS server gets pounded by some foreign
> (russian, I believe) server with a ton of port 53 DNS traffic. It's all
> invalid traffic, for lame servers that I've never had, etc. The problem is,
> the traffic continues unabated for sometimes days on end, constant, which
> drives up my bandwidth costs.  I have on several occasions in the past asked
> my data center host to tell me from the router logs where all the traffic is
> coming from, and they've been able to show me which IP it is that is
> pounding my DNS server. I then immediately add that IP to my blackhole list
> in the BIND configuration, and the traffic completely drops off.
>
> Of all the various services I have on my box, DNS seems to be the only one
> I've not found a good solution to how to have server logs which tell me what
> is being accessed, and more specifically, WHO is doing it (similar to mail
> or apache logs).

Do the logging{} directives not give you the information you want?
The below lines tell me what IP is asking for what in query.log, and
regular messages in named.log:

logging {
        channel logfile {
                file "/var/log/named.log";
                severity info;
                print-time yes; print-category yes; print-severity yes;
                };
        channel query_log {
                file "/var/log/query.log";
                severity info;
                print-time yes; print-category yes; print-severity yes;
                };
        category queries { query_log; };
        category default { logfile; };
        category lame-servers{ null; };
};

> What I would like is a way to have all the DNS connections logged in some
> way, so that I could (without bothering my data center host) find out which
> IP is hitting my server. Another idea (even better) would be if BIND had
> some way to automatically throttle or black-hole an IP if it has too many
> DNS hits within a certain small amount of time. I know mail servers have
> this, and also I think apache. But I've never found anything like this for
> BIND.
>
> Does anyone have any ideas on what I could do? Perhaps I could build into my
> mysql DLZ queries some sort of mysql-based logging of the requesting IP?  I
> dunno, but I just REALLY need to find a way to solve this. Any help would be
> greatly appreciated.

Use iptables rate limiting:

http://www.debian-administration.org/articles/187
http://www.geocities.com/youssef116/writing/ratelim.html

The really nice thing about the Debian article is that you can set a
generic rule for port 53 that will automatically match and drop
packets when a host sends more than X new connections per INTERVAL
(seconds, minutes, hours, etc).

The geocities page also mentions a LOG target so that you can _see_
when it actually does it (will be in kernel dmesg output and usually
some log file in /var/log/ ).

-- 
Regards...      Todd
All truth passes through three stages. First, it is ridiculed. Second,
it is violently opposed. Third, it is accepted as being self-evident.

------------------------------------------------------------------------------
Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA
-OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise
-Strategies to boost innovation and cut costs with open source participation
-Receive a $600 discount off the registration fee with the source code: SFAD
http://p.sf.net/sfu/XcvMzF8H