Hacker News Reader

Comment by kuschku | Hacker News Reader

On the other hand, it improves safety and security for many users.

Because on most distros, using unbound or BIND9 as local DNS server, they bind to all interfaces, publicly.

Which is the reason why DNS amplification DDoS even is possible.

I’ve seen it often enough happen, and basically every person who’s set up their own servers has made the mistake of leaving the defaults.

View on HN

This has nothing to do with this conversation. DNS recursors are not being discussed. This is strictly about DNS resolvers.

But who runs a DNS server? 99% of users only do DNS resolution and for that you don't need to run a DNS server on your system.

Many people run a DNS server to cache DNS responses locally. And they don’t want to expose the DNS server publicly. systemd-resolved does that, you can’t even expose it accidentally.

But many distros actually install a DNS server by default, usually unbound or BIND9, and while some bind it to localhost, many bind it to all interfaces.

As you said, that’s not necessary for most users, yet, major distros do it.

> cache DNS responses locally

I believe there is a built-in solution in glibc:

http://prefetch.net/blog/index.php/2011/03/27/configuring-ns...

Which distros install a DNS server (and enable it) by default? I've never seen this.

dnsmasq has been installed as a local DNS cache on Ubuntu and other Debian derivatives for many years. /etc/resolv.conf normally points at localhost.

It only listens on localhost though (127.0.1.1 by default), so it's not possible for it to be abused for dns amplification attacks.

IIRC dnsmasq still listens on all interfaces for some reason

Which is exactly the issue I mentioned.

You get on some distros by default something that that makes you subject to DNS amplification attacks.

It is supposed to reject requests from the addresses it does not listen on. I just found it strange that it binds on all interfaces regardless.

I’ve noticed it respond with an error packet – which ended up being used for DNS Amplification nonetheless.

I thought DNS was connectionless? Don't all DNS clients have to bind to UDP port 53 to function correctly?

It's not the port that matters; it's the interface. A caching DNS service for a simple desktop experience should only be listening for queries on the localhost interface (lo).

FreeBSD has named. In 9.0 it's BIND. In 10.0 & 11.0 it's Unbound.

You need to explicitly enable it, and it only listens on localhost by default.

On Debian, and I assume its derivates, Unbound will by default only listen to localhost. What distribution has changed this, because I think that is also the upstream default?

Ubuntu 14.04 and Debian old-old-stable listened on all interfaces.

The versions provided by most cloud hosters are also misconfigured to listen on all interfaces.

Hm, as far as I can tell Debian has never shipped a version which listens to something other than localhost by default. The upstream fixed this in 2007, before Debian started packaging Unbound.

Every person who has followed my and Daniel J. Bernstein's recommendations when setting up their own servers will not have done any such thing. We have been giving these recommendations for the better part of two decades now.

* http://jdebp.eu./FGA/proxy-server-ip-addresses.html

* http://cr.yp.to/djbdns/run-cache.html

Reply on news.ycombinator.com