{"id":248,"date":"2012-04-16T01:33:31","date_gmt":"2012-04-15T23:33:31","guid":{"rendered":"http:\/\/blog.techmedia.pl\/?p=248"},"modified":"2012-04-16T01:36:55","modified_gmt":"2012-04-15T23:36:55","slug":"zabezpieczenie-binda-w-iptables","status":"publish","type":"post","link":"https:\/\/www.techmedia.pl\/blog\/zabezpieczenie-binda-w-iptables\/","title":{"rendered":"Zabezpieczenie Binda w iptables"},"content":{"rendered":"<p>Jak odpowiada\u0107 na rekursywne ataki DNS, DoS lub DDoS?<\/p>\n<p>Poni\u017cej kilka przyk\u0142ad\u00f3w konfiguracji iptables:<\/p>\n<p>Objawem atak\u00f3w jest wpis w logach Binda podobny do poni\u017cszego i powtarzaj\u0105cy si\u0119 nawet kilka razy na sekund\u0119 z r\u00f3\u017cnych adres\u00f3w IP lub ca\u0142y czas z tego samego.<\/p>\n<pre>query (cache) 'isc.org\/ANY\/IN'<\/pre>\n<p>Na pocz\u0105tku przed innymi regu\u0142ami dotycz\u0105cymi DNS&#8217;a nale\u017cy doda\u0107 poni\u017csze wpisy i zrestartowa\u0107 firewalla:<\/p>\n<pre>PUBLIC_IF=eth0 \/\/interfejs sieciowy publiczny\r\nIPTABLES=\/sbin\/iptables \/\/\u015bcie\u017cka do iptables\r\n\r\n$IPTABLES -A INPUT -i $PUBLIC_IF -p udp --dport 53 -m recent --set\r\n$IPTABLES -A INPUT -i $PUBLIC_IF -p udp --dport 53 -m recent --update --seconds 30 --hitcount 10 -j DROP<\/pre>\n<p>lub inny przyk\u0142ad:<\/p>\n<pre>PUBLIC_IF=eth0 \/\/interfejs sieciowy publiczny\r\nIPTABLES=\/sbin\/iptables \/\/\u015bcie\u017cka do iptables\r\n\r\n$IPTABLES -A INPUT -i $PUBLIC_IF -p udp --dport 53 -m recent --update --seconds 30 -j DROP\r\n$IPTABLES -A INPUT -i $PUBLIC_IF -p udp --dport 53 -m recent --update --seconds 30 --hitcount 10 --rttl --set -j DROP<\/pre>\n<p>poni\u017csze te\u017c mo\u017ce by\u0107 ciekawe:<\/p>\n<pre>PUBLIC_IF=eth0 \/\/interfejs sieciowy publiczny\r\nIPTABLES=\/sbin\/iptables \/\/\u015bcie\u017cka do iptables\r\n\r\n$IPTABLES -A INPUT -i $PUBLIC_IF -d $MAIN_IP -p udp --dport 53 -m state --state ESTABLISHED,RELATED -j DROP<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Jak odpowiada\u0107 na rekursywne ataki DNS, DoS lub DDoS? Poni\u017cej kilka przyk\u0142ad\u00f3w konfiguracji iptables: Objawem atak\u00f3w jest wpis w logach Binda podobny do poni\u017cszego i powtarzaj\u0105cy si\u0119 nawet kilka razy na sekund\u0119 z r\u00f3\u017cnych adres\u00f3w IP lub ca\u0142y czas z tego samego. query (cache) \u201aisc.org\/ANY\/IN\u2019 Na pocz\u0105tku przed innymi regu\u0142ami dotycz\u0105cymi DNS&#8217;a nale\u017cy doda\u0107 poni\u017csze [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[18,11,4],"tags":[29,25,30,28],"yst_prominent_words":[],"_links":{"self":[{"href":"https:\/\/www.techmedia.pl\/blog\/wp-json\/wp\/v2\/posts\/248"}],"collection":[{"href":"https:\/\/www.techmedia.pl\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.techmedia.pl\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.techmedia.pl\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.techmedia.pl\/blog\/wp-json\/wp\/v2\/comments?post=248"}],"version-history":[{"count":5,"href":"https:\/\/www.techmedia.pl\/blog\/wp-json\/wp\/v2\/posts\/248\/revisions"}],"predecessor-version":[{"id":252,"href":"https:\/\/www.techmedia.pl\/blog\/wp-json\/wp\/v2\/posts\/248\/revisions\/252"}],"wp:attachment":[{"href":"https:\/\/www.techmedia.pl\/blog\/wp-json\/wp\/v2\/media?parent=248"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.techmedia.pl\/blog\/wp-json\/wp\/v2\/categories?post=248"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.techmedia.pl\/blog\/wp-json\/wp\/v2\/tags?post=248"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https:\/\/www.techmedia.pl\/blog\/wp-json\/wp\/v2\/yst_prominent_words?post=248"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}