4 ms·

It is unsafe to configure Nginx to use any DNS resolver other than 127.0.0.1 ("resolver x.x.x.x") because the transaction ID can be predictible, and Nginx fails

by mrb 9y ago

It is unsafe to configure Nginx to use any DNS resolver other than 127.0.0.1 ("resolver x.x.x.x") because the transaction ID can be predictible, and Nginx fails to randomize the UDP source port. Gixy should check for that. Strangely the Nginx developers staunchly refuse to consider this a security flaw. See http://blog.zorinaq.com/nginx-resolver-vulns/ http://blog.zorinaq.com/nginx-resolver-vulns/

nonsince 9y ago
This is an excellent writeup (I don't know if it's yours or not). I am frankly baffled that the Nginx team refuses to fix it, since there is a working PoC and it would be almost trivial to fix.
user5994461 9y ago
It is more than unsafe. It is plain stupid. There is no resolver running on 127.0.0.1 ... except on a couple of systems. If I have to make an educated guess, the guy who wrote that is running on Ubuntu.
- mrb 9y ago
  You don't understand. The recommendation is to INSTALL and CONFIGURE a resolver service accessible via the loopback address. Whether you run a resolver locally or forward/tunnel securely to a remote trusted resolver is irrelevant.
- pbarnes_1 9y ago
  It takes 10 seconds to install unbound.
  - omginternets 9y ago
    >It takes 10 seconds to install unbound. And a lot longer to ensure people know to do this.
ericcholis 9y ago
So, what exactly is the best way to mitigate this attack vector? While informative, the post only goes into detail about the attack; not a complete solution for the original intended purpose of the resolver setting. Is the dnsmasq solution here[1] sufficient? Or, should I edit dhclient.conf to add the desired name servers[2] [1] https://unix.stackexchange.com/questions/128220/how-do-i-set-my-dns-when-resolv-conf-is-being-overwritten#163506 https://unix.stackexchange.com/questions/128220/how-do-i-set... [2] https://unix.stackexchange.com/questions/128220/how-do-i-set-my-dns-when-resolv-conf-is-being-overwritten#154538 https://unix.stackexchange.com/questions/128220/how-do-i-set...
- mrb 9y ago
  Using "resolver 127.0.0.1" is an effective mitigation against all issues I documented.
Something1234 9y ago
Why does an HTTP server need to have a dns resolver? What purpose does it serve?
- fooey 9y ago
  to reverse proxy to a domain
- pas 9y ago
  It's only needed if you configure proxy_pass http://<domain http://<domain name> ... (and probably other forms of _pass, such as fcgi_pass) If you use a specific IP, resolver is not needed.

by mrb 9y ago

nonsince 9y ago

This is an excellent writeup (I don't know if it's yours or not). I am frankly baffled that the Nginx team refuses to fix it, since there is a working PoC and it would be almost trivial to fix.

user5994461 9y ago

It is more than unsafe. It is plain stupid. There is no resolver running on 127.0.0.1 ... except on a couple of systems. If I have to make an educated guess, the guy who wrote that is running on Ubuntu.

mrb 9y ago
You don't understand. The recommendation is to INSTALL and CONFIGURE a resolver service accessible via the loopback address. Whether you run a resolver locally or forward/tunnel securely to a remote trusted resolver is irrelevant.
pbarnes_1 9y ago
It takes 10 seconds to install unbound.
- omginternets 9y ago
  >It takes 10 seconds to install unbound. And a lot longer to ensure people know to do this.

ericcholis 9y ago

So, what exactly is the best way to mitigate this attack vector? While informative, the post only goes into detail about the attack; not a complete solution for the original intended purpose of the resolver setting. Is the dnsmasq solution here[1] sufficient? Or, should I edit dhclient.conf to add the desired name servers[2] [1] https://unix.stackexchange.com/questions/128220/how-do-i-set-my-dns-when-resolv-conf-is-being-overwritten#163506 https://unix.stackexchange.com/questions/128220/how-do-i-set... [2] https://unix.stackexchange.com/questions/128220/how-do-i-set-my-dns-when-resolv-conf-is-being-overwritten#154538 https://unix.stackexchange.com/questions/128220/how-do-i-set...

mrb 9y ago
Using "resolver 127.0.0.1" is an effective mitigation against all issues I documented.

Something1234 9y ago

Why does an HTTP server need to have a dns resolver? What purpose does it serve?

fooey 9y ago
to reverse proxy to a domain
pas 9y ago
It's only needed if you configure proxy_pass http://<domain http://<domain name> ... (and probably other forms of _pass, such as fcgi_pass) If you use a specific IP, resolver is not needed.