<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span data-ogsc="black" data-ogsb="white" style="font-size: 12pt; margin: 0px; color: black; background-color: white;" class="ContentPasted0">Hello guys,</span>
<div data-ogsc="black" data-ogsb="white" style="font-size: 12pt; margin: 0px; color: black; background-color: white;">
<br class="ContentPasted0">
</div>
<div data-ogsc="black" data-ogsb="white" style="font-size: 12pt; margin: 0px; color: black; background-color: white;" class="ContentPasted0">
I see, my server is authoritative for some internal domain, so I will try Allow-query. Thank you.</div>
<div data-ogsc="black" data-ogsb="white" style="font-size: 12pt; margin: 0px; color: black; background-color: white;" class="ContentPasted0">
But the attack is from my allowed IP addresses so I can't block the entire zone. </div>
<div data-ogsc="black" data-ogsb="white" style="font-size: 12pt; margin: 0px; color: black; background-color: white;">
<br class="ContentPasted0">
</div>
<div data-ogsc="black" data-ogsb="white" style="font-size: 12pt; margin: 0px; color: black; background-color: white;" class="ContentPasted0">
I tried NXDOMAINS-PER-SECOND but server is not giving nxdomain response but servfail. </div>
<span data-ogsc="black" data-ogsb="white" style="font-size: 12pt; margin: 0px; color: black; background-color: white;" class="ContentPasted0">How about ERRORS-PER-SECOND: sets the limit of error (REFUSED,FORMERR or SERVFAIL)?</span><br>
</div>
<div class="elementToProof">
<div id="Signature">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div></div>
<div></div>
<div></div>
<div></div>
<div></div>
<div></div>
<div></div>
<div></div>
<div></div>
<div></div>
<div id="divtagdefaultwrapper" dir="ltr" style="color: rgb(0, 0, 0);">
<p style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; margin-top:0px; margin-bottom:0px">
</p>
<div class="MsoNormal" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; margin-top:0px; margin-bottom:0px">
<a name="_MailAutoSig" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;"><b><span style="font-size: 10pt; font-family: Tahoma, "sans-serif"; color: black;"><br>
</span></b></a></div>
<div class="MsoNormal" style="margin-top: 0px; margin-bottom: 0px;"><font face="Tahoma, sans-serif"><span style="font-size: 13.3333px;"><b>BR, Nyamka</b></span></font></div>
<br>
<p style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; margin-top:0px; margin-bottom:0px">
</p>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> bind-users <bind-users-bounces@lists.isc.org> on behalf of Matus UHLAR - fantomas <uhlar@fantomas.sk><br>
<b>Sent:</b> Wednesday, March 29, 2023 3:24 PM<br>
<b>To:</b> bind-users@lists.isc.org <bind-users@lists.isc.org><br>
<b>Subject:</b> Re: Bind dns amplification attack</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">>On 3/28/23 11:28 AM, Matus UHLAR - fantomas wrote:<br>
>>Yes, this is one of the problem "authoritative zones for local use".<br>
<br>
On 28.03.23 12:18, Grant Taylor via bind-users wrote:<br>
>Authorizing the /zone/ for local use wasn't the problem. The problem <br>
>was that the world could get some of that zone's data from the query <br>
>cache even if they couldn't query the zone directly.<br>
<br>
when was this?<br>
<br>
querying cache is by default allowed for the same clients as recursion, <br>
perhaps unless it was old BIND version.<br>
<br>
<br>
>>The default root "hint" zone is only available for those who have <br>
>>recursion available.<br>
<br>
>I feel like the "root hint zone" is considerably different than "root <br>
>zone" proper. The fact that they have different zone types seems to <br>
>support that.<br>
<br>
yes. The content of hint zone is abused to generate aplification attack:<br>
<br>
Mar 26 16:03:53 fantomas named[1654]: client @0xe7379d50 195.88.25.138#59467 (.): query (cache) './ANY/IN' denied<br>
<br>
If you have local root zone, response is provided by default, it can be <br>
huge:<br>
<br>
% dig +noanswer +noadditional +nocomments +nocmd +noquestion -t any . @fantomas.fantomas.sk<br>
;; Query time: 0 msec<br>
;; SERVER: 195.80.174.185#53(195.80.174.185)<br>
;; WHEN: Wed Mar 29 09:23:27 CEST 2023<br>
;; MSG SIZE rcvd: 2904<br>
<br>
<br>
but default "type hint" root is treated as cache and REFUSED is sent.<br>
<br>
<br>
-- <br>
Matus UHLAR - fantomas, uhlar@fantomas.sk ; <a href="https://apc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.fantomas.sk%2F&data=05%7C01%7Cnyamkhand%40mobinet.mn%7Ce2277362d75540e64c5a08db3026c8ad%7Cca63e6528b2e4e0e8b691fd46774bdeb%7C1%7C0%7C638156715398463210%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Ptkbassm4yqO9YHpwHvKL7XC%2B0X9l9tRmKyWcdsw6PM%3D&reserved=0">
https://apc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.fantomas.sk%2F&data=05%7C01%7Cnyamkhand%40mobinet.mn%7Ce2277362d75540e64c5a08db3026c8ad%7Cca63e6528b2e4e0e8b691fd46774bdeb%7C1%7C0%7C638156715398463210%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Ptkbassm4yqO9YHpwHvKL7XC%2B0X9l9tRmKyWcdsw6PM%3D&reserved=0</a><br>
Warning: I wish NOT to receive e-mail advertising to this address.<br>
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.<br>
On the other hand, you have different fingers.<br>
-- <br>
Visit <a href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.isc.org%2Fmailman%2Flistinfo%2Fbind-users&data=05%7C01%7Cnyamkhand%40mobinet.mn%7Ce2277362d75540e64c5a08db3026c8ad%7Cca63e6528b2e4e0e8b691fd46774bdeb%7C1%7C0%7C638156715398463210%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=pGpLOzFdeNgqUHxCwPuiKUfPFTffOfcqcm6HQQEcuYg%3D&reserved=0">
https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.isc.org%2Fmailman%2Flistinfo%2Fbind-users&data=05%7C01%7Cnyamkhand%40mobinet.mn%7Ce2277362d75540e64c5a08db3026c8ad%7Cca63e6528b2e4e0e8b691fd46774bdeb%7C1%7C0%7C638156715398463210%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=pGpLOzFdeNgqUHxCwPuiKUfPFTffOfcqcm6HQQEcuYg%3D&reserved=0</a>
to unsubscribe from this list<br>
<br>
ISC funds the development of this software with paid support subscriptions. Contact us at
<a href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.isc.org%2Fcontact%2F&data=05%7C01%7Cnyamkhand%40mobinet.mn%7Ce2277362d75540e64c5a08db3026c8ad%7Cca63e6528b2e4e0e8b691fd46774bdeb%7C1%7C0%7C638156715398463210%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=abpXRElm5blZlXIcdRrRebQONm1d51pxuEcHCx4l2Po%3D&reserved=0">
https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.isc.org%2Fcontact%2F&data=05%7C01%7Cnyamkhand%40mobinet.mn%7Ce2277362d75540e64c5a08db3026c8ad%7Cca63e6528b2e4e0e8b691fd46774bdeb%7C1%7C0%7C638156715398463210%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=abpXRElm5blZlXIcdRrRebQONm1d51pxuEcHCx4l2Po%3D&reserved=0</a>
for more information.<br>
<br>
<br>
bind-users mailing list<br>
bind-users@lists.isc.org<br>
<a href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.isc.org%2Fmailman%2Flistinfo%2Fbind-users&data=05%7C01%7Cnyamkhand%40mobinet.mn%7Ce2277362d75540e64c5a08db3026c8ad%7Cca63e6528b2e4e0e8b691fd46774bdeb%7C1%7C0%7C638156715398463210%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=pGpLOzFdeNgqUHxCwPuiKUfPFTffOfcqcm6HQQEcuYg%3D&reserved=0">https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.isc.org%2Fmailman%2Flistinfo%2Fbind-users&data=05%7C01%7Cnyamkhand%40mobinet.mn%7Ce2277362d75540e64c5a08db3026c8ad%7Cca63e6528b2e4e0e8b691fd46774bdeb%7C1%7C0%7C638156715398463210%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=pGpLOzFdeNgqUHxCwPuiKUfPFTffOfcqcm6HQQEcuYg%3D&reserved=0</a><br>
</div>
</span></font></div>
<div id="footer" style="background-color:#D5EAFF; border:1px solid #003333; padding:.7em; ">
<span style="font-size:12pt;font-weight:bold; font-family: 'times new roman'; color:#ff0000;">Мэдэгдэл</span><br>
<p style="font-size:10pt;text-align:justify; line-height:10pt; font-family: 'times roman';">
Энэхүү цахим шуудан нь (хавсралтуудын хамт) зөвхөн энэхүү мэдээллийг хаягласан, хүлээн авах эрх бүхий этгээдэд зориулагдсан болно. Уг цахим шууданд агуулагдсан мэдээлэл нь хуулиар хамгаалагдсан, нууцлалын зэрэгтэй бөгөөд аливаа санамсаргүй тохиолдолоор танд
илгээгдсэн ч хуулиар хамгаалагдсан эрх нь өөрчлөгдөхгүй юм. Хэрэв та уг цахим шууданг хаяглан илгээсэн хүлээн авагч биш бол энэхүү цахим шууданг илгээгчид хариу цахим шуудан илгээх замаар мэдэгдэж, илгээгдсэн болон хариу цахим шууданг өөрийн системээс нэн
даруй устгах арга хэмжээг авна уу. Түүнчлэн энэхүү захидалд агуулагдсан мэдээллийг аливаа хэлбэрээр задруулах, хуулбарлах, бусдад тараах болон уг мэдээлэлтэй холбоотой ямарваа нэгэн үйлдэл хийх, эс үйлдэх зэрэг хууль бус бөгөөд хориотой юм.
</p>
</div>
<div id="footer" style="background-color:#D5EAFF; border:1px solid #003333; padding:.7em; ">
<span style="font-size:12pt;font-weight:bold; font-family: 'times new roman'; color:#ff0000;">Disclaimer</span><br>
<p style="font-size:10pt;text-align:justify; line-height:10pt; font-family: 'times roman';">
This email (including any attachments) is intended only to be read and used by the addressee. It may contain confidential or legally privileged information, which is not waived if it is mistakenly delivered to you. If you are not the intended recipient, please
immediately notify the sender by return email and delete both messages from your system; any disclosure, copying, distribution, or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful.
</p>
</div>
</body>
</html>