DNS Server Spoofed Request Amplification DDoS - Prevention
- by Shackrock
I've been conducting security scans, and a new one popped up for me:
DNS Server Spoofed Request Amplification DDoS
The remote DNS server answers to any request. It is possible to query
the name servers (NS) of the root zone ('.') and get an answer which
is bigger than the original request. By spoofing the source IP
address, a remote attacker can leverage this 'amplification' to launch
a denial of service attack against a third-party host using the remote
DNS server.
General Solution: Restrict access to your DNS server from public
network or reconfigure it to reject such queries.
I'm hosting my own DNS for my website. I'm not sure what the solution is here... I'm really looking for some concrete detailed steps to patch this, but haven't found any yet. Any ideas?
CentOS5 with WHM and CPanel.
Also see: http://securitytnt.com/dns-amplification-attack/