4 ms·

Not sure how I missed out the "Ask HN", thanks for reminding me. Regarding the DNS, have you run into any issues with people using your DNS server for DoS ampl

Not sure how I missed out the "Ask HN", thanks for reminding me. Regarding the DNS, have you run into any issues with people using your DNS server for DoS amplification attacks? Also would you be able to share which DNS server software you are running?

LinuxBender 8y ago
For a while, I ran bind. Then for quite a while, I used a modified version of rbldnsd, which is not really meant to be used that way, but it was very good at absorbing abuse and didn't even implement most record types. It just had what I required. When I eventually needed a proper DNS servers again so that I could have CAA records, I switched to NSD [1]. NSD is stricly authoritative, vs. its counter-part Unbound [2] for recursive. It is a little faster than bind and has not had quite as many CVE's associated with it as bind. That said, bind was there for a long time and they learned along the way. You can find sites that compare the features and benefits of NSD vs. bind. I have not been used for amplification attacks. That said, people have tried enumerating many things over the years. There are some things you can do both in the DNS config and in iptables to reduce some noise. You would want to look on serverfault [3] for ideas. I set really high TTL records, so DDoS would only affect people that have not used my site in a while. [1] - NSD: https://www.nlnetlabs.nl/projects/nsd/about/ https://www.nlnetlabs.nl/projects/nsd/about/ [2] - Unbound: https://nlnetlabs.nl/projects/unbound/about/ https://nlnetlabs.nl/projects/unbound/about/ [3] - Serverfault: https://serverfault.com/ https://serverfault.com/
- jamieweb 8y ago
  Thanks for the info, this will be really useful. :)
LinuxBender 8y ago
I forgot to add that NSD lacks query logging. If you need query logging, stick with bind, or you would have to use one of the packet capture daemons that passively records DNS and those tend to increase CPU load.
- jamieweb 8y ago
  Thanks for pointing that out - it's something I wouldn't need in production but logging is always useful for debugging.

LinuxBender 8y ago

For a while, I ran bind. Then for quite a while, I used a modified version of rbldnsd, which is not really meant to be used that way, but it was very good at absorbing abuse and didn't even implement most record types. It just had what I required. When I eventually needed a proper DNS servers again so that I could have CAA records, I switched to NSD [1]. NSD is stricly authoritative, vs. its counter-part Unbound [2] for recursive. It is a little faster than bind and has not had quite as many CVE's associated with it as bind. That said, bind was there for a long time and they learned along the way. You can find sites that compare the features and benefits of NSD vs. bind. I have not been used for amplification attacks. That said, people have tried enumerating many things over the years. There are some things you can do both in the DNS config and in iptables to reduce some noise. You would want to look on serverfault [3] for ideas. I set really high TTL records, so DDoS would only affect people that have not used my site in a while. [1] - NSD: https://www.nlnetlabs.nl/projects/nsd/about/ https://www.nlnetlabs.nl/projects/nsd/about/ [2] - Unbound: https://nlnetlabs.nl/projects/unbound/about/ https://nlnetlabs.nl/projects/unbound/about/ [3] - Serverfault: https://serverfault.com/ https://serverfault.com/

jamieweb 8y ago
Thanks for the info, this will be really useful. :)

LinuxBender 8y ago

I forgot to add that NSD lacks query logging. If you need query logging, stick with bind, or you would have to use one of the packet capture daemons that passively records DNS and those tend to increase CPU load.

jamieweb 8y ago
Thanks for pointing that out - it's something I wouldn't need in production but logging is always useful for debugging.