I normally do not work with windows too much, but being on call this week I ended up having to fix a problem on a Windows 2008 server. I didn’t find any documentation online, so I figured I’d add this post.
For anyone running Parallels Plesk (unknown version, but I know our web admin always keeps these up to date) make sure you lock down your ISC BIND instance. If not, you will probably run into a DNS amplification attack which will cause named.exe to used ALL your memory and probably even crash.
2013-04-22 Update: Plesk was set to only allow localnets recursion, however the built in localnets acl seems to be broken.
"localnets" - matches all the IP address(es) and subnetmasks of the server on which BIND is running. For example, if the server has a single interface with an IP address of 192.168.2.3 and a netmask of 255.255.255.0 (or 192.168.2.2/24) then localnets will match 192.168.2.0 to 192.168.2.255 and 127.0.0.1 (the loopback is always present and has a single address, that is a netmask of 255.255.255.255). Some systems do not provide a way to determine the prefix lengths of local IPv6 addresses. In such a case, localnets only matches the local IP addresses, just like localhost though in this case it will apply to external and internal (same host) requests.
Are you affected?
tcpdump:
1
12:28:00.121351 IP x.x.x.x.19135 > x.x.x.x.53: 10809+ [1au] ANY? isc.org. (36)
bind logs:
12345
12:28:00.643 client x.x.x.x#49046: query: isc.org IN ANY +ED (x.x.x.x)
12:28:00.644 client x.x.x.x#25135: query: isc.org IN ANY +ED (x.x.x.x)
12:28:00.645 client x.x.x.x#19771: query: isc.org IN ANY +ED (x.x.x.x)
12:28:00.646 client x.x.x.x#44031: query: isc.org IN ANY +ED (x.x.x.x)
12:28:00.647 client x.x.x.x#31518: query: isc.org IN ANY +ED (x.x.x.x)
2013-04-22 Update:Plesk will overwrite “allow-recursion { trusted; };” with the selection you have set in the web gui dns configuration with any, localnets or none. If you choose localnets (good choice), this feature may not work properly, so you will have to set the named.user.conf file immutable (read-only). If you do not, your changes *will revert.
2013-04-22 Update #2: *DO NOT set your file read only. Plesk Panel will break.. apperently it needs read/write access just to start. How about we just disable recursion. No need for this to be used as a resursive DNS server. It only needs to serve zones it’s authority for. You can disable recursion as a whole in the web gui under DNS… hopefully this is finally over.
Now with this in place, here is the query again
notice we also allow the trusted acl recursion
123456789101112131415161718
dig ANY isc.org @x.x.x.x +edns=0
; <<>> DiG 9.8.1-P1 <<>> ANY isc.org @x.x.x.x +edns=0
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 53084
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;isc.org. IN ANY
;; Query time: 50 msec
;; SERVER: x.x.x.x#53(x.x.x.x)
;; WHEN: Sat Apr 20 18:08:19 2013
;; MSG SIZE rcvd: 36
