3 ms·

dnsmasq has been installed as a local DNS cache on Ubuntu and other Debian derivatives for many years. /etc/resolv.conf normally points at localhost.

• deleted 9y ago
  [deleted]
• dsp1234 9y ago
  It only listens on localhost though (127.0.1.1 by default), so it's not possible for it to be abused for dns amplification attacks.
  • dom0 9y ago
    IIRC dnsmasq still listens on all interfaces for some reason
    • afuchs 9y ago
      I thought DNS was connectionless? Don't all DNS clients have to bind to UDP port 53 to function correctly?
      • smhenderson 9y ago
        It's not the port that matters; it's the interface. A caching DNS service for a simple desktop experience should only be listening for queries on the localhost interface (lo).
    • kuschku 9y ago
      Which is exactly the issue I mentioned. You get on some distros by default something that that makes you subject to DNS amplification attacks.
      • dom0 9y ago
        It is supposed to reject requests from the addresses it does not listen on. I just found it strange that it binds on all interfaces regardless.
        • kuschku 9y ago
          I’ve noticed it respond with an error packet – which ended up being used for DNS Amplification nonetheless.