Portál AbcLinuxu, 27. dubna 2024 01:18
Od: NFOservers.com DDoS notifier
Komu: abuse@netbox.cz
Předmět: Open recursive resolver used for an attack: 83.240.112.222
Datum: 2014-11-14 04:36:05
You appear to be running an open recursive resolver at IP address 83.240.107.108
that participated in an attack against a customer of ours, generating large UDP
responses to spoofed queries, with those responses becoming fragmented because of
their size.
Please consider reconfiguring your resolver in one or more of these ways:
- To only serve your customers and not respond to outside IP addresses (in BIND,
this is done by defining a limited set of hosts in "allow-query"; with a Windows
DNS server, you would need to use firewall rules to block external access to UDP
port 53)
- To only serve domains that it is authoritative for (in BIND, this is done by
defining a limited set of hosts in "allow-query" for the server overall but
setting "allow-query" to "any" for each zone)
- To rate-limit responses to individual source IP addresses (such as by using DNS
Response Rate Limiting or iptables rules)
More information on this type of attack and what each party can do to mitigate it
can be found here: http://www.us-cert.gov/ncas/alerts/TA13-088A
If you are an ISP, please also look at your network configuration and make sure
that you do not allow spoofed traffic (that pretends to be from external IP
addresses) to leave the network. Hosts that allow spoofed traffic make possible
this type of attack.
Example DNS responses from your resolver during this attack are given below.
Timestamps (far left) are PDT (UTC-7), and the date is 2014-11-13.
18:25:47.977451 IP (tos 0x0, ttl 52, id 24962, offset 0, flags [+], proto UDP
(17), length 1500) 83.240.107.108.53 > 66.150.188.x.26763: 41910 11/2/0
wradish.com. TXT[|domain]
0x0000: 4500 05dc 6182 2000 3411 40a7 53f0 6b6c E...a...4.@.S.kl
0x0010: 4296 bcf5 0035 688b 0efa f896 a3b6 8180 B....5h.........
0x0020: 0001 000b 0002 0000 0777 7261 6469 7368 .........wradish
0x0030: 0363 6f6d 0000 ff00 01c0 0c00 1000 0100 .com............
0x0040: 000d 7104 05ff 7465 7374 2074 6573 7420 ..q...test.test.
0x0050: 7465 te
18:25:47.984342 IP (tos 0x0, ttl 52, id 24963, offset 0, flags [+], proto UDP
(17), length 1500) 83.240.107.108.53 > 66.150.188.x.48542: 31514 11/2/0
wradish.com. MX[|domain]
0x0000: 4500 05dc 6183 2000 3411 40a6 53f0 6b6c E...a...4.@.S.kl
0x0010: 4296 bcf5 0035 bd9e 0efa a9ce 7b1a 8180 B....5......{...
0x0020: 0001 000b 0002 0000 0777 7261 6469 7368 .........wradish
0x0030: 0363 6f6d 0000 ff00 01c0 0c00 0f00 0100 .com............
0x0040: 000d 7100 1900 0004 736d 7470 0c73 6563 ..q.....smtp.sec
0x0050: 7572 ur
18:25:48.115673 IP (tos 0x0, ttl 52, id 24965, offset 0, flags [+], proto UDP
(17), length 1500) 83.240.107.108.53 > 66.150.188.x.61319: 31514 11/2/0
wradish.com. MX[|domain]
0x0000: 4500 05dc 6185 2000 3411 40a4 53f0 6b6c E...a...4.@.S.kl
0x0010: 4296 bcf5 0035 ef87 0efa b00b 7b1a 8180 B....5......{...
0x0020: 0001 000b 0002 0000 0777 7261 6469 7368 .........wradish
0x0030: 0363 6f6d 0000 ff00 01c0 0c00 0f00 0100 .com............
0x0040: 000d 7100 1f00 0a0a 6d61 696c 7374 6f72 ..q.....mailstor
0x0050: 6531 e1
(The final octet of our customer's IP address is masked in the above output
because some automatic parsers become confused when multiple IP addresses are
included. The value of that octet is "245".)
-John
President
Nuclearfallout, Enterprises, Inc. (NFOservers.com)
(We're sending out so many of these notices, and seeing so many auto-responses,
that we can't go through this email inbox effectively. If you have follow-up
questions, please contact us at noc@nfoe.net.)
a i když s angličtinou jsem na štíru mám pocit, že jim vadí právě ten otevřený port. Co jsem zkoušel nastavení, tak buď mi zůstal otevřený, nebo jsem nemohl ven - nejsem síťař a zkoušet tohle metodou pokus/omyl asi není nejchytřejší
co bych měl udělat pls?
že jim vadí právě ten otevřený portano
Co jsem zkoušel nastavení, tak buď mi zůstal otevřený, nebo jsem nemohl venCo jsi zkousel a jak?
ale najednou mi vzrostla obsazenost disku na routeru z 6 na cca 12asi se ti plni log v souvisloti s utokem
config rule
option target 'REJECT'
option src 'wan'
option proto 'tcp udp'
takhle to bylo
config defaults option syn_flood '1' option input 'DROP' option output 'DROP' option forward 'DROP' option drop_invalid '1' config zone option name 'lan' option input 'ACCEPT' option output 'ACCEPT' option network 'lan' option forward 'REJECT' config zone option name 'wan' option output 'ACCEPT' option masq '1' option mtu_fix '1' option network 'wan wan6 IPv6' option input 'DROP' option forward 'DROP'Jinak řádek "option network 'wan wan6 IPv6'" může u tebe vypadat trochu jinak důležité jsou option s input, output a forward a pokud ten port nemáš někde jinde povolen v tom souboru tak se z internetu na router nedostaneš.
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option syn_flood '1'
option output 'ACCEPT'
option input 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'lan'
option output 'ACCEPT'
option network 'lan'
option input 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wan6'
option input 'ACCEPT'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config zone
option name 'quest'
option forward 'REJECT'
option output 'ACCEPT'
option network 'guest'
option input 'ACCEPT'
config forwarding
option dest 'wan'
option src 'quest'
config forwarding
option dest 'quest'
option src 'wan'
quest je nastavená síť pro kamarády - nesatvoval jsem ji podle nějakýho návodu na netu
co se týká základního nastavení - nevím jak jsem to dokázal, ale po instalaci jsem měl z venku vidět port 53, tellnet, ssh i luci ...
config defaults
option syn_flood '1'
option output 'DROP'
option input 'DROP'
option forward 'DROP'
config zone
option name 'lan'
option output 'ACCEPT'
option network 'lan'
option input 'ACCEPT'
option forward 'DROP'
config zone
option name 'wan'
option output 'ACCEPT'
option forward 'DROP'
option masq '1'
option mtu_fix '1'
option network 'wan wan6'
option input 'DROP'
config zone
option name 'quest'
option forward 'DROP'
option output 'ACCEPT'
option network 'guest'
option input 'ACCEPT'
config forwarding
option src 'quest'
option dest 'wan'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
PS. Doufám že jsem se nikde nesek přímo konfiguráky jsem dlouho neupravoval.
Jinak toto tam nesmí bít:
config forwarding
option dest 'quest'
option src 'wan'
A wan samozřejmě musí mít povolen pouze output (odchozí pakety) a né forward nebo input!
marek@debian-desktop:~$ nmap -Pn 83.240.112.222 Starting Nmap 6.47 ( http://nmap.org ) at 2014-11-14 22:44 CET Nmap scan report for ip4-83-240-112-222.cust.nbox.cz (83.240.112.222) Host is up (0.00043s latency). Not shown: 999 closed ports PORT STATE SERVICE 53/tcp open domain Nmap done: 1 IP address (1 host up) scanned in 38.12 seconds marek@debian-desktop:~$
petr@soban:~$ nmap -Pn 83.240.112.222 Starting Nmap 6.40 ( http://nmap.org ) at 2014-11-14 23:18 CET Nmap scan report for ip4-83-240-112-222.cust.nbox.cz (83.240.112.222) Host is up (0.011s latency). All 1000 scanned ports on ip4-83-240-112-222.cust.nbox.cz (83.240.112.222) are filtered Nmap done: 1 IP address (1 host up) scanned in 126.64 seconds petr@soban:~$
root@router:~# cat /rom/etc/config/firewall config defaults option syn_flood 1 option input ACCEPT option output ACCEPT option forward REJECT # Uncomment this line to disable ipv6 rules # option disable_ipv6 1 config zone option name lan list network 'lan' option input ACCEPT option output ACCEPT option forward ACCEPT config zone option name wan list network 'wan' list network 'wan6' option input REJECT option output ACCEPT option forward REJECT option masq 1 option mtu_fix 1 config forwarding option src lan option dest wan # We need to accept udp packets on port 68, # see https://dev.openwrt.org/ticket/4108 config rule option name Allow-DHCP-Renew option src wan option proto udp option dest_port 68 option target ACCEPT option family ipv4 # Allow IPv4 ping config rule option name Allow-Ping option src wan option proto icmp option icmp_type echo-request option family ipv4 option target ACCEPT # Allow DHCPv6 replies # see https://dev.openwrt.org/ticket/10381 config rule option name Allow-DHCPv6 option src wan option proto udp option src_ip fe80::/10 option src_port 547 option dest_ip fe80::/10 option dest_port 546 option family ipv6 option target ACCEPT # Allow essential incoming IPv6 ICMP traffic config rule option name Allow-ICMPv6-Input option src wan option proto icmp list icmp_type echo-request list icmp_type echo-reply list icmp_type destination-unreachable list icmp_type packet-too-big list icmp_type time-exceeded list icmp_type bad-header list icmp_type unknown-header-type list icmp_type router-solicitation list icmp_type neighbour-solicitation list icmp_type router-advertisement list icmp_type neighbour-advertisement option limit 1000/sec option family ipv6 option target ACCEPT # Allow essential forwarded IPv6 ICMP traffic config rule option name Allow-ICMPv6-Forward option src wan option dest * option proto icmp list icmp_type echo-request list icmp_type echo-reply list icmp_type destination-unreachable list icmp_type packet-too-big list icmp_type time-exceeded list icmp_type bad-header list icmp_type unknown-header-type option limit 1000/sec option family ipv6 option target ACCEPT # include a file with users custom iptables rules config include option path /etc/firewall.user ### EXAMPLE CONFIG SECTIONS # do not allow a specific ip to access wan #config rule # option src lan # option src_ip 192.168.45.2 # option dest wan # option proto tcp # option target REJECT # block a specific mac on wan #config rule # option dest wan # option src_mac 00:11:22:33:44:66 # option target REJECT # block incoming ICMP traffic on a zone #config rule # option src lan # option proto ICMP # option target DROP # port redirect port coming in on wan to lan #config redirect # option src wan # option src_dport 80 # option dest lan # option dest_ip 192.168.16.235 # option dest_port 80 # option proto tcp # port redirect of remapped ssh port (22001) on wan #config redirect # option src wan # option src_dport 22001 # option dest lan # option dest_port 22 # option proto tcp # allow IPsec/ESP and ISAKMP passthrough #config rule # option src wan # option dest lan # option protocol esp # option target ACCEPT #config rule # option src wan # option dest lan # option src_port 500 # option dest_port 500 # option proto udp # option target ACCEPT ### FULL CONFIG SECTIONS #config rule # option src lan # option src_ip 192.168.45.2 # option src_mac 00:11:22:33:44:55 # option src_port 80 # option dest wan # option dest_ip 194.25.2.129 # option dest_port 120 # option proto tcp # option target REJECT #config redirect # option src lan # option src_ip 192.168.45.2 # option src_mac 00:11:22:33:44:55 # option src_port 1024 # option src_dport 80 # option dest_ip 194.25.2.129 # option dest_port 120 # option proto tcp root@router:~#
Tiskni
Sdílej:
ISSN 1214-1267, (c) 1999-2007 Stickfish s.r.o.
15.11.2014 19:01
