KB ID 0000981

Problem

I got a Tweet this morning, to say the site was down.

I checked and the VPS was off-line? So I powered it on and waited a few minutes. Linux is not one of my strongest technical areas so I did some Googling about what logs to check etc. When I looked in the var/log/messages log it was full of these, up to the point where it went down;

[box] Aug 7 03:51:52 MY-HOSTNAME named[490]: error (unexpected RCODE REFUSED) resolving ‘anotherdomain.com.ru/ANY/IN’: 123.123.123.123#53 [/box]

After some more reading it became clear that I’d been used in part of a DDOS DNS amplification attack. This was possible because the DNS BIND server that I was running had DNS recursion enabled. This means that if it can’t resolve a DNS query then it attempts to resolve the DNS query for you, (currently this is the default setting). You can check yours online with this tool, (you don’t want it to say ‘open’).

Solution

Disable BIND DNS Recursion (From the Console)

1. Log onto the server directly or via SSH, navigate to, and open the named.conf file.

[box]cd /etc
vi named.conf [/box]

2. Near the top of the file locate ‘recursion yes;‘

3. Press ‘I’ to go into ‘insert’ mode, using the arrow keys navigate to ‘yes’ and change it to ‘no’, Press {Esc} then to save and exit type ZZ (for some reason :wq wouldn’t save on mine!).

4. Then restart BIND DNS. Check once again with the tool and hopefully now it will say ‘no response’

[box] service named restart[/box]

Disable BIND DNS Recursion (From Webmin)

1. Log into Webmin > Servers > DNS BIND Server > Edit Config File.

2. Change ‘recursion yes;‘ to ‘recursion no;‘ > Save.

3. In the top right hand corner click ‘Stop BIND’ then ‘Start BIND’.

Related Articles, References, Credits, or External Links

NA