Добрый день.
Мой маленький VPS сервачек заблокировали из за того что типо у меня не закрыта дырка в DNS. Текст письма такой:
Our network administrators have detected abnormal activity consistent with an external vulnerability scan. It was also determined that the BIND server running on your container is open to exploitation a DNS amplification attack as an Open DNS Resolver. The worry is that a party is building a list of known exploitable servers for use in an attack against some unknown third party.
You are required to make changes such that the BIND server does not resolve DNS queries except for those domains hosted on your server.
You can modify the following files:
/etc/resolv.conf - set the nameserver to be 8.8.8.8 if it is currently set to 127.0.0.1 or localhost /etc/named.conf - add the following line to the «options» stanza:
allow-recursion { 1.2.3.4/24; 127.0.0.1/16;};
FAQ: What is DNS amplification attack? http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack
Note that while we can be reasonably sure that these changes will protect your server from being used as part of an attack against a third party, the overall security of your server is the responsibility of your server administrator, as the servers we sell are all self-managed and that any attempts by technical support to improve your server security is a gesture of goodwill and not a guaranteed resolution. Please reply that you are willing to make this change and we will reinstate the account to allow you to do so as soon as possible.
В качестве DNS сервера у меня unbound. Я честно говоря еле настроил этот unbound, пару доменов и забыл, а тут прилетело...
Никто не сталкивался как закрыть эту «дырку» в unbound?
