A lo largo de distintos artículos os he ido comentando que no me considero ningún experto en el ámbito de la administración de sistemas, pero está visto que la gente aburrida desea que poco a poco vaya aprendiendo a base de ataques :).

Os he explicado ya cómo solucionar un bug del plugin JCE Editor de la plataforma Joomla, mediante el cual se podía acceder al servidor y ejecutar cualquier script que quisiéramos. En mi caso concreto, dicho script se encargaba de intentar enviar emails desde el servicio qmail saturando así la cola y generando tantos ficheros que finalmente el disco duro se saturaba completando el 100% de los inodos disponibles.

Pues bien, ayer se dedicaron a utilizar una pequeña puerta trasera en el servicio named del servidor (encargado de gestionar las DNS), de forma que, enviaban más de 500 peticiones por segundo llegando a saturar dicho proceso, hasta que finalmente era imposible acceder al servidor mediante cualquier dominio que estuviera asociado a él (tan solo se podía acceder mediante IP, es decir, todos los dominios alojados en dicho servidor, eran inaccesibles )

El error que recibí fue el siguiente:

Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#49447: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#39775: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#54700: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#44672: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#45949: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#36342: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#33404: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#34711: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#56172: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#47107: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#35203: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#49415: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#34866: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#54192: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#40977: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#36974: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#41106: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#60998: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#47675: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#37941: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#41712: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#56945: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#34715: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#57796: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#57781: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#49565: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#34603: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#39537: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#40891: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#32867: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#59581: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#41414: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#42313: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#48602: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#54254: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#58717: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#43129: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#53978: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#44490: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#48826: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#42414: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#35795: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#54924: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#45727: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#39134: query (cache) 'search.yippy.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#37564: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#32949: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 11.111.11.11#33418: query (cache) 'search.yippy.com.kimsufi.com/A/IN' denied
Nov 28 23:24:26 ksXXXXXXX named[5193]: client 127.0.0.1#47958: query (cache) 'search.yippy.com/A/IN' denied

Por motivos de seguridad he cambiado la ip en el ejemplo, donde pone 11.111.11.11 realmente es la ip de mi servidor :).

Esto es un pequeño extracto de todo el syslog que generaba, como veréis a simple vista todas estas líneas se cargaban en el mismo segundo.

Para solucionar esto, accedí al archivo de configuración /etc/bind/named.conf  (otros tendréis este fichero en /etc/named.conf o en cualquier otro directorio, para ello ejecutad locate named.conf )

Dentro de él, en el apartado options global, añadí las siguientes líneas:

allow-query-cache { none; };
recursion no;
additional-from-auth no;
additional-from-cache no;
minimal-responses yes;

De forma que el fichero named.conf quedó así:

options {
        directory "/var/bind";
        //allow-recursion {127.0.0.1;};

        // uncomment the following lines to turn on DNS forwarding,
        // and change the forwarding ip address(es) :
        //forward first;
        //forwarders {
        //      123.123.123.123;
        //      123.123.123.123;
        //};

        // listen-on-v6 { none; };
        // listen-on { 127.0.0.1; };
        allow-query-cache { none; };

        recursion no;
        additional-from-auth no;
        additional-from-cache no;
        minimal-responses yes;

        // to allow only specific hosts to use the DNS server:
        //allow-query {
        //      127.0.0.1;
        //};

        // if you have problems and are behind a firewall:
        //query-source address * port 53;
        pid-file "/var/run/named/named.pid";
};

Reinicié el proceso mediante /etc/init.d/named restart y listo.

Hasta el momento no he tenido más problemas, espero que os sirva 🙂