CentOS – Disable BIND DNS Recursion

KB ID 0000981

Problem

I got a Tweet this morning, to say the site was down.

Tweet Websit Down

I checked and the VPS was off-line? So I powered it on and waited a few minutes. Linux is not one of my strongest technical areas so I did some Googling about what logs to check etc. When I looked in the var/log/messages log it was full of these, up to the point where it went down;

Aug 7 03:51:52 MY-HOSTNAME named[490]: error (unexpected RCODE REFUSED) resolving ‘anotherdomain.com.ru/ANY/IN’: 123.123.123.123#53

After some more reading it became clear that I’d been used in part of a DDOS DNS amplification attack. This was possible because the DNS BIND server that I was running had DNS recursion enabled. This means that if it can’t resolve a DNS query then it attempts to resolve the DNS query for you, (currently this is the default setting). You can check yours online with this tool, (you don’t want it to say ‘open’).

Solution

Disable BIND DNS Recursion (From the Console)

1. Log onto the server directly or via SSH, navigate to, and open the named.conf file.

cd /etc vi named.conf

Tweet Websit Down

2. Near the top of the file locate ‘recursion yes;

CENTOS DNS Recursion

3. Press ‘I’ to go into ‘insert’ mode, using the arrow keys navigate to ‘yes’ and change it to ‘no’, Press {Esc} then to save and exit type ZZ (for some reason :wq wouldn’t save on mine!).

Disable BIND recursion

4. Then restart BIND DNS. Check once again with the tool and hopefully now it will say ‘no response’

service named restart

Disable BIND recursion

Disable BIND DNS Recursion (From Webmin)

1. Log into Webmin > Servers > DNS BIND Server > Edit Config File.

Webmin BIND DNS Edit

2. Change ‘recursion yes;‘ to ‘recursion no;‘ > Save.

Webmin BIND config file

3. In the top right hand corner click ‘Stop BIND’ then ‘Start BIND’.

Webmin BIND config file

Related Articles, References, Credits, or External Links

NA

 

Author: Migrated

Share This Post On