5 ms·
Great write-up and very helpful for those of us who, despite doing so for years, remain amateurs at running our own servers. I am among those who think the Int
by bhauer 13y ago
Great write-up and very helpful for those of us who, despite doing so for years, remain amateurs at running our own servers. I am among those who think the Internet would be better as a whole if more people did in fact run servers—server software would gradually become easier for us amateurs to install and run without leaving it in a state that is open to nefarious exploits. But for the time being, I appreciate it when experts take the time to explain simple counter-measures as you have done. Thank you!
As far as I am aware, I am not responsible for any Internet-facing NTP servers (I certainly never set one up willingly), but it's good to have this in the back of my mind now in the off-chance that I ever do set one up.
I did have one of my Windows machines used for DNS amplification. I wrote about the incident [1] at my blog because I had been a bit surprised that it was not sufficient to simply disable recursion. That much had seemed like common sense, and I thought I had been so clever and thorough in turning it off. But later I found attackers were leveraging my server's willingness to provide a list of root DNS servers in response, even with recursion disabled. I ended up deleting the list of root servers and the problem went away. (Though, to be clear, I never ran the incident by any DNS experts, so I may have misdiagnosed the whole thing.)
I don't know what else I don't know about amplification attacks, so reports such as yours are helpful for people like myself who find it fun to run our own servers, but don't consider it an area of expertise.
[1] http://tiamat.tsotech.com/dns-amplification http://tiamat.tsotech.com/dns-amplification
- rhizome 13y agoNot knowing about this particular vulnerability doesn't make one a pejorative amateur.
- bhauer 13y agoI am part of the group I was referring to as amateurs, and I was not using the word in a pejorative manner. I mean it literally. We, the amateurs I am speaking of, are not experts at server administration and do it either out of necessity, for fun, or out of principal. For me, it's a bit of fun and principle—I feel it's a good thing for me to more or less know how to manage a server even as I acknowledge that experts know much more about it than I. I would like to see servers demystified in general, and that's why I applaud articles such as this one that make the necessary counter-measures/workarounds plain and clear for those like myself.
- rhizome 13y agoThat's all well and good, and I wish you luck in your ambitions, but you're still making a category error.
- bhauer 13y agoI'm reaching to understand the point you're making. I assume you mean that you interpret what I've said as implying anyone who does not know about NTP amplification attacks is an amateur server administrator. I do not mean to imply that. I simply mean that for people like myself, who are in fact amateur server administrators, this sort of down-to-earth style of article (here is what the problem is; here is how to deal with it) is very welcome. Although it's only academic at this point, I am curious why you think I used the word "amateur" pejoratively and what category you believe I am describing in error. I ask simply because I'd like to avoid making similar errors in the future.
- rhizome 13y agoBecause you more-than-implied that nobody who got hit with it is a professional.
- asdf1011 13y agoWe have some racks with public facing ILOM interfaces which sit outside the firewall, which turns out have ntpd running. We only noticed when our international bandwidth crawled to a halt due to them being used in an NTP attack. It's a hassle, as they're old machines and out of support contract (so we can't upgrade the firmware), and so far as I can tell there's no way to turn off public access to ntpd over the admin interfaces. We're stuck with having to go to the hosting company and change the cabling to route them through the firewall. Just because you didn't set up ntpd doesn't mean you don't have it running (somewhere).