Joe Abley wrote:

Throw on an ACL to restrict recursive lookups (and to deny queries, if the servers aren't also authority servers) and the problem frequently goes away.

I'd be interested to see a working BIND 9 ACL to restrict recursion to certain clients only. -- Juha Saarinen www.geekzone.co.nz/juha | Skype: juha_saarinen blogs.pcworld.co.nz/pcworld/techsploder www.computerworld.co.nz | MSN: juha_saarinen(a)msn.com Voice: +64 9 950 3023 Subtle recursive jokes in .sigs are not funny.

On Fri, 2007-01-19 at 13:02 +1300, joshua sahala wrote:

...

Joe Abley wrote:

...

Throw on an ACL to restrict recursive lookups (and to deny queries, if the servers aren't also authority servers) and the problem frequently goes away.

I'd be interested to see a working BIND 9 ACL to restrict recursion to certain clients only.

in named.conf:

acl "localonly" { 192.168.1.0/24; ... 192.168.250.0/24; };

options {

....

allow-recursion { "localonly"; };

....

};

see the BIND admin reference manual for more info (or one of the many howtos available on teh intarwebs)

/joshua

Is there a significant difference between doing this and setting up two different BIND "views"? I'm currently using two view, one for our internal networks, and one for external networks, with an ACL to decide which view applies and recursion disabled for the external view. I've noticed that with a "views" configuration, the external view is very slow to update (the servers are run as slaves) when the master is updated. The internal view updates almost immediately, but it can be up to an hour or so before queries hitting the external view get the up-to-date records. Would I be losing anything important if I switched to just using the allow-recursion ACL? I suspect views might have been designed for a different configuration scenario... -- --Michael Fincham Unleash Technology Solutions

On 18-Jan-2007, at 18:48, Juha Saarinen wrote:

Joe Abley wrote:

...

Throw on an ACL to restrict recursive lookups (and to deny queries, if the servers aren't also authority servers) and the problem frequently goes away.

I'd be interested to see a working BIND 9 ACL to restrict recursion to certain clients only.

Ask Team Cymru and ye shall receive. All that, and more! http://www.cymru.com/Documents/secure-bind-template.html Joe

We kept getting the following messages: named[4498]: client 127.0.0.1#42127: no more recursive clients: quota reached (We have a limit of 1000 and an average of 25)

from the BIND 9.2 ARM: recursive-clients The maximum number of simultaneous recursive lookups the server will perform on behalf of clients. The default is 1000. Because each recursing client uses a fair bit of memory, on the order of 20 kilobytes, the value of the recursive-clients option may have to be decreased on hosts with limited memory.

And we could not get to some of the root servers, ie: a.ROOT-SERVERS.NET

how were you testing this? did you try any of the other root servers? If any of the root server were inaccessible it would have caused a whole lot more noise on teh intarwebs.

So I am assuming there was a DOS attack somewhere which affected DNS traffic.

where somewhere == your server

Assumption: The name server could not get to some root servers, the queries kept pilling up and we hit the quota.

I think you need to look closer to home, so to speak... Is this DNS server of your publicly accessible? If so, does it allow recursion from anywhere/anyone? If so, then you become a free DNS server for others, like spammers. Try restricting recursion to your network only. If it is already restricted, then check all your network hosts for signs of malware/virii/backdoors/etc as it seems possible that an internal host or two was spewing spam and making a lot of bogus recursive queries hth /joshua -- A common mistake that people make when trying to design something completely foolproof is to underestimate the ingenuity of complete fools. - Douglas Adams -