11 ms·
How and why I run my own DNS servers
- fleitz 14y agoAs for the SSH attempts just move it to a different port, disable password logins. SSH shouldn't really be accessible on the same IP as any publicly facing service for your domain. It invites this kind of automated scanning, which is actually a huge risk unless you're on top of your patches. Also change your SSH config to misreport the OS/SSH version. The IP for SSH access should then be heavily filtered to only SSH and the requisite ICMP packets. Have you considered using Route53 / Cloudflare?
- pwelch 14y agoAnother solution I like is adding fail2ban. It adds a rule to iptables to block the IP after a set number of incorrect attempts and you can set when to unblock it.
- ChuckMcM 14y agoOr fail2ban which puts in iptables rules to ban IPs that fail to login. The ssh scrapers try a variety of user accounts, and it is pretty easy to spot them (for example root can't login on my system from anywhere except the physical console, so trying to login as root,bin,games,demo,Etc from ssh is an instant ban. Of course you need to not run an open DNS resolver which means 'don't do recursive lookups for anything except your trusted addresses'. I saw one setup that worked really well which was to only do recursive lookups from loopback, then client would create a vpn tunnel to the dns server, get their dns service that way. Seemed a bit extreme but it allows off site DNS service.
- jstalin 14y agoI use fail2ban as well. I honestly don't get why people get so worked up about SSH. As long as you have a long, secure password, how is it a security vulnerability?
- jacquesm 14y agoBecause if there is an exploit that allows an attacker to recover your password for instance from a session replay then you're instantly open.
- ChuckMcM 14y agoSo split the conversation, there are little threats and big threats. I don't have 6 locks on a steel door at my house, the big threats are going to break the picture window and walk in that way. So if you're running one of the 100s of millions of non-descript servers out there then fail2ban and putting ssh on a non-standard port will keep the opportunists out of your server (at least via ssh). If they are using a zero day against you, or are waiting to capture traffic to do a plaintext attack they aren't opportunists, they are gunning for you. That is a different threat model.
- jacquesm 14y agoUnfortunately I have to deal with both, but you're 100% right, those are definitely different categories.
- cbs 14y agoLooking at it from a defense-in-depth perspective, its another layer of protection. Even if you use fail2ban and mandate key-based logins, it answers questions like "what if there is a 0day for my sshd?" Its not a bad idea, it just happens that careful sshd practices are good enough that more layers are subject to highly diminished returns.
- leephillips 14y agoI removed fail2ban after it prevented me from logging in to my server from a Panera cafe. It took me a long time to figure out what was going on after logging in from a second server: someone had been trying to break in some days before from the IP that I happened to be using. So fail2ban could be a problem if you work from the road.
- beagle3 14y ago> So fail2ban could be a problem if you work from the road. Your config is bad. Mine is set up for a 12 hour ban. From my logs, it's perfectly sufficient to drop all scanners (I rarely see an IP banned more than twice, and even twice is not common). If I were to login from a place where an attacker is trying to log in, I would actually appreciate not being exposed - they might only be using networks, but they might also be using cameras and other stuff that would compromise my info.
- zrail 14y agoThanks, that's a good tip, I'll work on that today. I had considered Route53 but it's actually in the same ballpark as this setup, money wise, and it's less flexible for what I want it to do. I haven't evaluated Cloudflare at all yet.
- pfg 14y agoI'm using CloudFlare (without the proxy/CDN feature) just because of their awesome DNS management. Haven't had any issues and it's got a really neat interface.
- jacquesm 14y agoHaving a fake open 22 is actually a great way to build up a blocklist.
- haxxorfreak 14y agoUntil you need to login from a different machine, forget the -p flag and get yourself blacklisted. :)
- jacquesm 14y agoThat would never happen to me. Ahem.
- deleted 14y ago[deleted]
- ramidarigaz 14y agoI've been running kippo (ssh honeypot) with a really weak root password. It's really entertaining to watch people break in and try to muck around.
- krickle 14y agoI was thinking giving any hacking attempt some sort of fake shell access would be a great learning experience, how awesome is it that other people had that thought and made it.
- ChuckMcM 14y agoFor a while I had one of the DEC VAXes in my collection attached to the network identifying itself as KREMVAX (old usenet joke) it was fun watching people try to break into it. (they could as guest, which had the password guest). It was particularly fun to watch young people who were new to the scene sort of freak out at this weird architecture. Old farts were easy to spot, they would start right away with a 'show dev' or 'set host' to try to move around the network. Kind of like a hacker aquarium.
- 14y ago
- ramidarigaz 14y agoHow do you change the reported OS/SSH version? I didn't see any obvious lines in sshd_config that do that.
- Sami_Lehtinen 14y agoI decided to enable port knocking. So SSH is not available on any port, without right kind of packets being sent beforehand.
- hackerboos 14y agoSecurity through obscurity.
- zwily 14y agoObscurity is fine as a layer in your security strategy.
- throwaway125 14y agoWith Moxie Marlinspike's KnockKnock[1] port knocking offers real additional security. 1) http://www.thoughtcrime.org/software/knockknock/ http://www.thoughtcrime.org/software/knockknock/
- biot 14y agoYes, much like choosing an obscure sequence of bits to function as one half of a public/private keypair during an SSH protocol handshake.
- hackerboos 14y agoNot quite.
- Sami_Lehtinen 14y agoPort Knocking packets can have strong crypto payload. So yes, it's not really any different than using VPN. (Yes it is technically yes, but it allows you to open access from one IP address, using strong authentication for service, which still got strong authenticaiton. TOTP, private key and password.) It's just front blocking access to that tcp port without the right opening packet.
- larrys 14y ago"To host your own DNS servers the registrars require you to list two IP addresses " Registrar here. This may be a requirement of some registrars but not a requirement of all registrars. And in any case you can fake this (see warning) by simply using the same IP address with a different host name or by using a different IP address with a made up IP address. Warning: Obviously you should have two valid DNS servers no doubt. I am simply pointing out that there are work arounds to this especially if you are trying to get up and running and won't have the 2nd dns operational for a short period of time you can at least get started with DNS that should work (since it only takes one and assuming that one is working you will be serving up records.)
- koide 14y agoAnd there are some registrars that offer a secondary DNS free of additional charge just for this case.
- onetwothreefour 14y agoSome ccTLDs actually require 4 NS servers on different subnets. I'll leave you to guess which one. :)
- thaumaturgy 14y agoMind if I ask which registrar? Just curious. My email address is in my profile.
- jaytaylor 14y agoI'd also like to know which reg.. Jay [at> jaytaylor dot com
- dsl 14y agoAs a registrar you should know this is actually a requirement of the registry and varies based on TLD policy. (maybe you meant you're a reseller?)
- larrys 14y ago
- jstanley 14y ago"To host your own DNS servers the registrars require you to list two IP addresses with the idea that you'll be providing redundant service. The one thing you don't want is downtime with DNS, it screws everything up." I've got around this by having two hostnames for one machine. The way I see it, since all my services are on this one machine anyway, I'll have bigger problems than DNS if the machine is down: there will be nothing at the address the names are pointing to, so who cares if they resolve properly?
- zrail 14y agoFair point. I've got email and DNS distributed onto both machines so I don't lose anything, and prgmr was pretty clear that I couldn't have a second IP just to fake out DNS so I went with a whole second server.
- uxp 14y agoAlso, if your email box goes down and is unreachable then the sending server should retry later when it can't get a response. If that box is also your DNS server, and the sending email server is unable to lookup the MX record it will automatically bounce. Having a slave/secondary email server should mitigate this to some extent though. Many applications do plan for unreachable services, but throwing the fault down the stack screws up how the error is handled. You can still use a primary application server box as a DNS server, but I would be certain that it's a secondary/slave server, not the primary server.
- eCa 14y agoThat sounds weird (what prgmr said). I've had dedicated servers running dns at several providers for ten years, and all I've ever done is get a second ip for the same machine and bind it to a different hostname.
- agwa 14y agoThings are different now. IPv4 addresses are almost gone so ARIN requires ISPs to have valid justification for every IP address they hold. "Faking out DNS" is not a valid justification.
- rachelbythebay 14y agoThose "machines" seem huge for what they're doing (DNS services for 32 zones). They add up to more resources than all of my machines put together from just a few years ago. I guess this is progress. It just seems strange to me.
- zrail 14y agoYeah they're way too beefy for what I'm using them for at the moment. My ongoing plan is to move various services onto these machines but it's been slow going.
- tom_fitzhenry 14y agoTo further improve reliability, consider using a secondary-as-a-service (as well as your self-hosted secondary name service). This will only work if tinydns supports zone transfers (AXFR/IXFR), which as far as I can tell, it doesn't. I don't use a self-hosted secondary. I use a secondary-as-a-service as my secondary /and primary/, which has the advantage of my VPS going down (for less than 4 weeks) wouldn't impact my DNS's uptime. I blogged about it this month: https://tom-fitzhenry.me.uk/blog/2012/12/host-your-own-dns-without-sacrificing-reliability.html https://tom-fitzhenry.me.uk/blog/2012/12/host-your-own-dns-w...
- zrail 14y agoBefore I picked up the Ramnode server I was using BuddyNS as my primary with the prgmr node as the stealth primary. It worked fine but it was less straightforward than I wanted.
- joe_bleau 14y agoI'm using prgmr and buddyns as secondaries to my djbdns primary. axfrdns (part of the djbdns package) handles the zone transfer requests, and I can force a transfer with a really simple perl script.
- tom_fitzhenry 14y agoThough the stealth primary solution involves more moving pieces, and introduces zone transfers, which are more complex than provisioning via puppet, I've had no noticeable issues. I say "noticeable issues", because although my DNS is monitored, the monitoring isn't granular enough to detect sub-minute outages, for example. Did you have any issues in particular with the stealth primary solution?
- zrail 14y agoNot any technical issues, it was just more moving pieces than I want. BuddyNS is a fine service but having to force an update with an email seemed pretty hacky.
- Sami_Lehtinen 14y agoWhy bother using Postfix for mail forwarding? Why not to use Gmail MX directly? I run my own servers with postfix, dovecot and roundcube. Therefore I don't need Gmail for anything. (It's also huge privacy issue.)
- zrail 14y agoI don't use google apps for my domains so Gmail MX wouldn't really work, plus I have some aliases that I think are maybe too complicated for Gmail. What do you think of roundcube? I haven't tried it yet, since php puts me off.
- Sami_Lehtinen 14y agoYeah, roundcube is the only reason I have installed PHP. I really would prefer not to use PHP. I don't personally like roundcube too much. For sure it's not great, but it does still work okish. I'm usually using proper mail client(s), so roundcube is just a backup. Btw. roundcube is also the reason why I'm running MySQL too. I'm using Python 3 & MongoDB with all of my own apps.
- aioprisan 14y agoWhat aliases could be too complicated for Gmail? Roundcube is an OK web email client, but let's be honest, it doesn't even match up what Gmail can offer you, in terms of integrated services like Google Docs, free phone dialing, video conferencing, etc.
- zrail 14y agoI have some stupid aliases that go to multiple people set up as virtual addresses in Postfix. I'm sure I could convince google to do that for me.
- IgorPartola 14y agoYes, Google Apps let you create mailing lists.
- kjackson2012 14y agoI ran my own DNS server from my own home DSL static IP address 10+ years ago. It's fairly innocuous as long as you only respond to DNS requests for your own domain and don't forward requests. But it ends up being more hassle than its worth. As recently as a few months ago, I hosted my own DNS server on a Linksys SLUG, but after I suffered a power outage and realized that there's no reason for hosting this stuff myself, I just decided to use namecheap.com for their Free DNS service.
- iSloth 14y agoPersonally I would have gone with a dedicated server from somewhere like OVH, about the same price as those VPS's with similar resources (but they are dedicated to you...) As for SSH, just move it on to a port other than 22, that will fix 99% of the bots trying to guess your password.
- MidnighToker 14y agobeen using ovh for years and really enjoy their self-manage tools (though I actually work for a different provider). fail2ban || denyhosts are also good ways of stopping ssh brute force :)
- aioprisan 14y agoRoute53 is a much better alternative to running your own service. I used to have a similar setup for taskup.com and other sites that I'm hosting but for the $0.20 that I pay every month to Amazon, I get weighted DNS responses based on the region that the request comes from and requests get served to the local server for that region, redundancy in 12+ zones, etc. The latency alone for a DNS lookup from India was about 300ms to our server in PA, but now it's under 30ms. Having said that, it's a good learning opportunity.
- onetwothreefour 14y agoThere's literally no reason to ever run your own DNS when Route53 and DNSMadeEasy exist.
- lesterbuck 14y agoMy reading of the Route53 prices is that you pay $.50/month/domain, plus query charges after a million. How do you pay $0.20/month? I find it very irritating that Amazon says "Pay only for what you use. There is no minimum fee." when there obviously is a minimum fee of $.50/month, even if zero queries are resolved. There are entire low end VPS servers that cost only marginally more ($14/yr) than what Route53 costs for one lousy domain, i.e. one entry in a database table.
- aioprisan 14y agosorry, that was supposed to be $1.50/month
- aioprisan 14y agowith Route53, it's not just another entry in a DNS zone file, you actually get multiple-zone IP addresses for each domain hosted, by default. Also, you get WRR and anycast, as well as latency based routing. Not to mention that you can create aliases that are not visible to resolvers but point to internal Amazon resources that you have access to.
- rscale 14y agoI switched to Route 53 (from TinyDNS with custom RoR/Postgres frontend) and I'm completely satisfied. The bills are tiny, the service has been reliable, the console lets me make all our desired records without a lot of hoop-jumping, and somebody else maintains everything. Migration was a one-day project, including DR. There are some added bonuses if you happen to be using other AWS services, but even without those, I think Route53 is one of Amazon's better offerings.
- chernevik 14y agoI do this myself off a Linode. It's neat to understand how this stuff actually works, it expands the imagination of what's possible. I like being able to quickly stand up a subdomain for development / testing / staging. I really want to get an email server running, I think the ability to spark up email addresses and servers for automated reporting or file distribution opens up some useful possibilities.
- dotBen 14y agoAs it goes, Linode has an amazing DNS service bundled with their instances - replicated between all their international datacenters. If you host with Linode I can't see why you wouldn't use it, unless you are just futzing/curious to roll your own.
- thaumaturgy 14y agoI also run my own domain name servers. I use PowerDNS with a MySQL backend; setting up replication between the two MySQL servers wasn't too hard, which gives me redundant name servers in two data centers. I have a few more than 32 zones, but the name services stuff has almost zero impact on server resources. Updating and querying the name records is a piece of cake thanks to the MySQL database, and if I ever get around to finishing it, I can have my own web-based front-end for it. Best of all, I can have a nice, short ttl on all of my entries, and PowerDNS is configured to always check the database, so I have a two minute refresh period on any changes made to entries on my name servers -- that alone has been well worth running my own. (Client: "Don't I have to wait like a few hours or a day or something for this to spread over the internet or something?" "Nope. 'Bout two minutes in most cases, little bit more for AT&T's customers.") I definitely didn't do it right the first time, though. DNS has a few gotchas, like making sure you disable axfr requests, making sure you have an SOA record for appropriate zones, and so on. I'm probably still doing something wrong, but I don't know what it is at this point. Also, the default recommended PowerDNS MySQL setup is needlessly complex, as far as I can tell.
- larrys 14y ago"and if I ever get around to finishing it, I can have my own web-based front-end for it." If you finish it let me know. I would be interested in possibly buying the front end from you (even if it's rough wouldn't be customer facing.)
- druiid 14y agoThere's several existing MySQL management solutions for powerDNS, including: https://www.poweradmin.org/trac/ https://www.poweradmin.org/trac/ https://github.com/averna-syd/PowerdnsTango https://github.com/averna-syd/PowerdnsTango PowerDNS Tango is the prettiest looking one.
- basilgohar 14y agoLooking at the featureset of these frontends, my own implementation pales in comparison. It would need a lot of work before matching the features these offer.
- druiid 14y agoFor many many years we ran our own DNS servers using PowerDNS with MySQL backends. That's all fine and well and it's a very powerful architecture and relatively reliable and strong to even high amounts of traffic... that was until we started regularly seeing 10Gbps+ DDoS attacks, so we put a DDoS protection service in front of the sites, but there wasn't really anything at the time capable of protecting the DNS servers as well. So a few months go by, everything has been fine and then another DDoS hits. Looking through the web-servers, not hitting there, all is fine. Study firewall traffic through the network and note that the majority of incoming traffic (that was making it through to the network that is), was headed to the DNS servers. The attackers were sending the DDoS to the DNS servers, requesting some of our root domains and given that it appeared as valid traffic there was not much to be done to filter any of it. The easy solution in this case happened to be blocking all Chinese and Russian IP's for a couple days which mitigated enough of it to solve. After that, we stopped hosting our own DNS. Moral of the story: DNS services are a great learning tool to use and PowerDNS is probably where you want to start, but at scale you may or may not want to actually run your own.
- larrys 14y ago(Thanks for the links you provided to the front ends in your other comment). Would like to point out that ddos is a ymmv item obviously for anyone scared off by the potential for this which is the same as the potential for any ddos attack and mitigation. A company affiliated with ours has been managing dns for a customer since 1996 with 10k zones. Back when you had to read Cricket Liu Oreilly book. (movie.edu if anyone remembers). They've never experienced a problem. All run on pretty low powered hardware for that matter. That said there are things to know about dns while not difficult time could be better spent elsewhere if there is no compelling reason to diy.
- dsl 14y agoDDoS risk is based on the type of business you're running (online casino, ecommerece, etc) and not really much to do with if you are running infrastructure in house or not. For that matter, I don't know of a reputable DDoS mitigation service that doesn't provide DNS hosting as part of the package. It's pretty core to the whole thing.
- Nick_C 14y agoHas anyone tried the PaperTrail service? I'm tempted except for the tiny window for queries, only a week. I'd like, say, a month at least.
- zrail 14y agoOnce you sign up you can customize your plan as much as you want, setting search retention to a month is a possibility. It's not cheap, though.
- spc476 14y agoI run my own DNS, but in a rather unique way. The registrar record points to my hosting company's DNS servers, but they are slaved off my DNS server; the only IPs that can hit my DNS server are the hosting company's. I make the changes I want, they're pushed out to the actual Internet facing DNS servers.
- lvh 14y agoTwisted[1] comes with a DNS server built-in. For non-authorative local DNS caches: twistd dns --recursive --cache For authorative servers, to serve a BIND-style zonefile: twistd dns --bindzone ZONEFILE But, of course, that's pretty boring. The fun stuff is when you have a Python source file as your zonefile! See: https://twistedmatrix.com/documents/current/names/howto/names.html https://twistedmatrix.com/documents/current/names/howto/name... twisted.names (that's the name of the DNS package) is simple enough to use for DNS serving (demonstrated above) and flexible enough to get it to do pretty much whatever you want.