[Admin]

معمولا ابیوز با عنوان زیر و به صورت اتوماتیک ارسال می شود:
Abuse Message [AbuseID:nnnnnn:nn]: AbuseBSI: [CB-Report#20180101-nnnnnnnn] Offene DNS-Resolver in ASnnnnn

نیاز به ارسال پاسخ به این ابیوز نیست ولی احتمالا در صورتی که بعد از این هشدارها از سرویس شما سوء استفاده ای صورت بگیره آی پی یا کل سرویس بلاک میشه!

به همین شکل استفاده شود چه مشکلی دارد؟
در این حالت افراد دیگر این امکان را دارند که از سرویس شما جهت حمله به دیگر سرویس ها و سرورها استفاده کنند و این باعث دریافت ابیوز جدی و بسته و حذف شدن سرویس شما می شود!


برای رفع مشکل:

A. در سرورهای ویندوزی: CMD را به صورت Run as administrator باز کرده و دستور زیر را کپی کرده و اینتر بزنید:

کد:

dnscmd <ServerName> /Config /NoRecursion {1|0}

و یا DNS Manager را از مسیر Start > Administrative Tools > DNS باز کرده و بر روی DNS سرور راست کلیک کرده و Properties را انتخاب کنید، بعد در تب Advanced کلیک کنید. در Server options تیک Disable recursion را فعال کرده و روی OK کلیک کنید.



B. در سرورهای لینوکسی: در صورتی که از BIND استفاده می کنید، فایل زیر را

کد:

/etc/named.conf

جهت ویرایش باز کنید و options را پیدا کرده و در زیر کدهای پیشفرض آن به این شکل اضافه کنید:

کد:

allow-query     { any; };
allow-transfer  { none; };
allow-recursion { localhost; };
recursion yes;

نمونه:

کد:

options {
        - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
        - If you are building a RECURSIVE (caching) DNS server, you need to enable
          recursion.
        - If your recursive DNS server has a public IP address, you MUST enable access
          control to limit queries to your legitimate users. Failing to do so will
          cause your server to become part of large scale DNS amplification
          attacks. Implementing BCP38 within your network would greatly
          reduce such attack surface
       */

       allow-query     { any; };
       allow-transfer  { none; };
       allow-recursion { localhost; };
       recursion yes;
};

حال سرویس فوق را رستارت کنید:

کد:

service named restart

نمونه متن ابیوز فوق:

We received a security alert from the German Federal Office for Information Security (BSI).
Please see the original report included below for details.

Please investigate and solve the reported issue.
It is not required that you reply to either us or the BSI.
If the issue has been fixed successfully, you should not receive any further notifications.

Additional information is provided with the HOWTOs referenced in the report.
In case of further questions, please contact ----- and keep the
ticket number of the original report [CB-Report#...] in the subject line.
Do not reply ----- as this is just the sender address for the
reports and messages sent to this address will not be read.

Kind regards

Abuse team

On 01 Jan 10:43, ----- wrote:
> Dear Sir or Madam,
>
> over the past months, DDoS reflection attacks using DNS amplification
> significantly increased, with a huge number of open DNS resolvers
> hosted in Germany participating in the attacks against third parties.
>
> Affected systems on your network:
>
> Format: ASN | IP | Timestamp (UTC)
> IP | 2018-01-01
>
> We would like to ask you to check if the open resolvers identified
> on your network are intentionally configured as such and appropriate
> countermeasures preventing their abuse for DDoS attacks have been
> implemented.
>
> If you have recently solved the issue but received this notification
> again, please note the timestamp included below. You should not
> receive any further notifications with timestamps after the issue
> has been solved.