5 ms·

What are the incentives for the maintainers of open DNS recursors? How can we alter their incentives so that they can no longer be used in DNS amplification att

What are the incentives for the maintainers of open DNS recursors? How can we alter their incentives so that they can no longer be used in DNS amplification attacks?

sterlingross 14y ago
There isn't much incentive save for the fact that it is easier to configure. For some versions of DNS servers you need to consciously disable recursive lookups and then configure the list of servers that are accepted. If a DNS server doesn't perform lookups for any outside server it isnt very useful. If you think about a web host, with X number of servers that host websites, these are considered the Master DNS servers when the physical domains being hosted reside on those servers. The public listed DNS servers on your domain WHOIS records are actually the Secondary DNS servers, and these perform the DNS lookups when someone accesses the hosted website on your Master server. If the Secondary server accepts requests from anyone, even domains it isn't explicitly responsible for, then it is performing recursive lookups. A more secure configuration is for the Secondary servers to only accept lookups for its own Master servers.
takeda64 14y ago
They set up a caching server for their organization so the DNS lookups are faster, but they forget to restrict the recursive queries only to their organization so anyone else can use them. That makes them work like Smurf ampliefiers (http://en.wikipedia.org/wiki/Smurf_attack http://en.wikipedia.org/wiki/Smurf_attack) in the past.
bradleyland 14y ago
There are some benefits (incentives) to running your own DNS server with the ability to perform recursive queries, but best practices dictate that these servers should only accept queries from "trusted clients". So, it's not so much that there are incentives to run an open recursor as it is there are very few negative incentives to running an open DNS recursor. I keep highlighting the word "open", because the open state of a DNS server is often not an intentional decision. I'd speculate the most common reason for using DNS recursion is to allow a non-authoritative name server to return results for any query. This non-authoritative name server usually sits on a network that serves clients with low latency and high bandwidth, like a LAN. The network is typically private, but private is not always the same as secure/closed. Some benefits of running your own DNS are: * The ability to cache DNS lookup results (speed increase) * Placing the name server closer to clients (speed increase) * The ability to blacklist certain zones (security) And many more, most of which relate to control, speed, and security. The thing is, none of these advantages are related to running an "open" DNS with recursive queries enabled. I think the core problem is twofold: 1) Many amateur sysadmins don't recognize that running a name server with recursive queries enabled is a security issue. 2) Enabling recursion doesn't automatically require any configuration to secure the client-trust relationship. Unfortunately, I'm not really smart enough to propose any changes that would help the situation, but I think this represents a high-level overview of the most common problem scenario. EDIT: It's also worth noting that some DNS servers enable recursive queries by default. Anyone running their own DNS for their zone, but who don't have knowledge of the issues related to recursive DNS will likely be running an open DNS recursor as well. These are commonly servers at web hosts, which have much faster internet connections as well. So it's a matter of getting everyone on board for changing defaults.
- rip747 14y ago
  why not just use opendns.com? you get all of these `benefits` and more without you having to configure and maintain a DNS server.
  - Scaevolus 14y ago
    Does OpenDNS still hijack addresses that don't resolve for ads?
    - jlgreco 14y ago
      Yes, they fuck with NXDOMAIN. I don't understand why anyone puts up with them. I suspect because they have the word "Open" in their name.
  - deleted 14y ago
    [deleted]
  - Cymen 14y ago
    One reason I don't use OpenDNS.com or Google DNS is that it means I might not hit the optimal CDN for me. Maybe they have improved things but last time I used it, I often ended up hitting CDN end points that were not optimal. For example, downloading MSDN content was slow. If I switched to my internet service providers DNS servers, I would hit a more optimal CDN end point that was faster. I had a similar experience with Netflix. Note my example with MSDN took place a while ago so it might be replicable today.
    - halfasleep 14y ago
      It might be worth trying again, at least in theory, you should get correct CDN endpoints whatever happens. I suppose there might be an exception to this if a CDN has edge nodes within your ISP though. There's a bit more detail at https://developers.google.com/speed/public-dns/faq#cdn https://developers.google.com/speed/public-dns/faq#cdn
      - 14y ago
devicenull 14y ago
For some it's a matter of knowing that they shouldn't be running a recursive server. We recently contacted a number of customers asking them to disable their recursive server, and most didn't really know they were running it, or that it was a problem.
- acqq 14y ago
  In my a-few-guys-in-one-office location we have a Windows domain server which has also a DNS server to which our computers are connected. I don't have the slightest idea if that DNS server is recursive or not and what wouldn't work if that setting would be changed. Any clever link where something really useful can be found? Wikipedia doesn't help me: http://en.wikipedia.org/wiki/Name_server#Recursive_query http://en.wikipedia.org/wiki/Name_server#Recursive_query Thanks in advance!
  - devicenull 14y ago
    It is recursive, and I honestly have no idea how to fix it. We're in a similar situation, and the only answers I can find for this involve disabling the DNS server (which would break AD). Honestly, your best bet is to firewall off UDP port 53 to all hosts except ones that are using it as a DNS server.
    - acqq 14y ago
      It seems my server schouldn't be a problem, it's behind the NAT and there's no port forwarding of port 53. If I would have to do the resoluion for the public nodes of my domain I'd anyway have a separate Linux or BSD node just for that, replying only the queries about my nodes. Anybody knows if I'm missing something in such a solution?
noselasd 14y ago
I did a search on the /24 block my DSL connection is part of, on openresolve. There were 14 open resolvers. Prodding a bit around at them , many of them are just linux machines people in my area put on the internet, and have just installed a DNS server on it, likely for caching purposes, but it isn't set up properly. Ofcourse these are DSL connections, so the upload rate is likely just 512kbit, but all you need is enough of them.
- jonknee 14y ago
  And there are many times more similarly configured *nix boxes in data centers (with data center bandwidth). Google's gigabit service could be an interesting block to search...

What are the incentives for the maintainers of open DNS recursors? How can we alter their incentives so that they can no longer be used in DNS amplification attacks?

sterlingross 14y ago

There isn't much incentive save for the fact that it is easier to configure. For some versions of DNS servers you need to consciously disable recursive lookups and then configure the list of servers that are accepted. If a DNS server doesn't perform lookups for any outside server it isnt very useful. If you think about a web host, with X number of servers that host websites, these are considered the Master DNS servers when the physical domains being hosted reside on those servers. The public listed DNS servers on your domain WHOIS records are actually the Secondary DNS servers, and these perform the DNS lookups when someone accesses the hosted website on your Master server. If the Secondary server accepts requests from anyone, even domains it isn't explicitly responsible for, then it is performing recursive lookups. A more secure configuration is for the Secondary servers to only accept lookups for its own Master servers.

takeda64 14y ago

They set up a caching server for their organization so the DNS lookups are faster, but they forget to restrict the recursive queries only to their organization so anyone else can use them. That makes them work like Smurf ampliefiers (http://en.wikipedia.org/wiki/Smurf_attack http://en.wikipedia.org/wiki/Smurf_attack) in the past.

bradleyland 14y ago

There are some benefits (incentives) to running your own DNS server with the ability to perform recursive queries, but best practices dictate that these servers should only accept queries from "trusted clients". So, it's not so much that there are incentives to run an open recursor as it is there are very few negative incentives to running an open DNS recursor. I keep highlighting the word "open", because the open state of a DNS server is often not an intentional decision. I'd speculate the most common reason for using DNS recursion is to allow a non-authoritative name server to return results for any query. This non-authoritative name server usually sits on a network that serves clients with low latency and high bandwidth, like a LAN. The network is typically private, but private is not always the same as secure/closed. Some benefits of running your own DNS are: * The ability to cache DNS lookup results (speed increase) * Placing the name server closer to clients (speed increase) * The ability to blacklist certain zones (security) And many more, most of which relate to control, speed, and security. The thing is, none of these advantages are related to running an "open" DNS with recursive queries enabled. I think the core problem is twofold: 1) Many amateur sysadmins don't recognize that running a name server with recursive queries enabled is a security issue. 2) Enabling recursion doesn't automatically require any configuration to secure the client-trust relationship. Unfortunately, I'm not really smart enough to propose any changes that would help the situation, but I think this represents a high-level overview of the most common problem scenario. EDIT: It's also worth noting that some DNS servers enable recursive queries by default. Anyone running their own DNS for their zone, but who don't have knowledge of the issues related to recursive DNS will likely be running an open DNS recursor as well. These are commonly servers at web hosts, which have much faster internet connections as well. So it's a matter of getting everyone on board for changing defaults.

rip747 14y ago
why not just use opendns.com? you get all of these `benefits` and more without you having to configure and maintain a DNS server.
- Scaevolus 14y ago
  Does OpenDNS still hijack addresses that don't resolve for ads?
  - jlgreco 14y ago
    Yes, they fuck with NXDOMAIN. I don't understand why anyone puts up with them. I suspect because they have the word "Open" in their name.
- deleted 14y ago
  [deleted]
- Cymen 14y ago
  One reason I don't use OpenDNS.com or Google DNS is that it means I might not hit the optimal CDN for me. Maybe they have improved things but last time I used it, I often ended up hitting CDN end points that were not optimal. For example, downloading MSDN content was slow. If I switched to my internet service providers DNS servers, I would hit a more optimal CDN end point that was faster. I had a similar experience with Netflix. Note my example with MSDN took place a while ago so it might be replicable today.
  - halfasleep 14y ago
    It might be worth trying again, at least in theory, you should get correct CDN endpoints whatever happens. I suppose there might be an exception to this if a CDN has edge nodes within your ISP though. There's a bit more detail at https://developers.google.com/speed/public-dns/faq#cdn https://developers.google.com/speed/public-dns/faq#cdn
    - 14y ago

devicenull 14y ago

For some it's a matter of knowing that they shouldn't be running a recursive server. We recently contacted a number of customers asking them to disable their recursive server, and most didn't really know they were running it, or that it was a problem.

acqq 14y ago
In my a-few-guys-in-one-office location we have a Windows domain server which has also a DNS server to which our computers are connected. I don't have the slightest idea if that DNS server is recursive or not and what wouldn't work if that setting would be changed. Any clever link where something really useful can be found? Wikipedia doesn't help me: http://en.wikipedia.org/wiki/Name_server#Recursive_query http://en.wikipedia.org/wiki/Name_server#Recursive_query Thanks in advance!
- devicenull 14y ago
  It is recursive, and I honestly have no idea how to fix it. We're in a similar situation, and the only answers I can find for this involve disabling the DNS server (which would break AD). Honestly, your best bet is to firewall off UDP port 53 to all hosts except ones that are using it as a DNS server.
  - acqq 14y ago
    It seems my server schouldn't be a problem, it's behind the NAT and there's no port forwarding of port 53. If I would have to do the resoluion for the public nodes of my domain I'd anyway have a separate Linux or BSD node just for that, replying only the queries about my nodes. Anybody knows if I'm missing something in such a solution?

noselasd 14y ago

I did a search on the /24 block my DSL connection is part of, on openresolve. There were 14 open resolvers. Prodding a bit around at them , many of them are just linux machines people in my area put on the internet, and have just installed a DNS server on it, likely for caching purposes, but it isn't set up properly. Ofcourse these are DSL connections, so the upload rate is likely just 512kbit, but all you need is enough of them.

jonknee 14y ago
And there are many times more similarly configured *nix boxes in data centers (with data center bandwidth). Google's gigabit service could be an interesting block to search...