Going through my logs, I just realized some part of my server might be compromised, although not an expert of Bind 9, I'm not sure what to correct in order to prevent this :
Oct 24 14:16:50 ip151 named[54864]: error (network unreachable) resolving 'www.gamasutra.com/A/IN': 2001:4800:7814:0:5008:8553:ff04:b151#53
Oct 24 14:16:50 ip151 named[54864]: error (network unreachable) resolving 'www.kitchenworksinc.com/A/IN': 2607:f208:302::2d#53
Oct 24 14:16:50 ip151 named[54864]: error (network unreachable) resolving 'gyogynovenyek-gyogyteak.com/A/IN': 2607:f0d0:1101:16f::6#53
Oct 24 14:16:50 ip151 named[54864]: error (network unreachable) resolving 'www.kitchenworksinc.com/AAAA/IN': 2607:f208:302::2d#53
Oct 24 14:16:50 ip151 named[54864]: error (network unreachable) resolving 'www.kitchenworksinc.com/A/IN': 2607:f208:206::2d#53
Oct 24 14:16:50 ip151 named[54864]: error (network unreachable) resolving 'www.kitchenworksinc.com/AAAA/IN': 2607:f208:206::2d#53
Oct 24 14:16:50 ip151 named[54864]: error (network unreachable) resolving 'gyogynovenyek-gyogyteak.com/AAAA/IN': 2607:f0d0:1101:16f::6#53
Oct 24 14:16:51 ip151 named[54864]: validating @0x7f4e1405ce60: www.gamasutra.com A: no valid signature found
Oct 24 14:16:51 ip151 named[54864]: validating @0x7f4e1c5befc0: gamasutra.com SOA: no valid signature found
Oct 24 14:16:51 ip151 named[54864]: validating @0x7f4e2008e200: www.gamasutra.com NSEC: no valid signature found
Oct 24 14:16:54 ip151 named[54864]: error (network unreachable) resolving 'www.utrinski.mk/A/IN': 2001:678:1::2#53
Oct 24 14:16:54 ip151 named[54864]: error (network unreachable) resolving 'www.utrinski.mk/AAAA/IN': 2001:678:1::2#53
Oct 24 14:16:54 ip151 named[54864]: error (network unreachable) resolving 'www.utrinski.mk/A/IN': 2001:628:453:bb::4#53
Oct 24 14:16:54 ip151 named[54864]: error (network unreachable) resolving 'www.utrinski.mk/AAAA/IN': 2001:628:453:bb::4#53
Oct 24 14:16:54 ip151 named[54864]: error (connection refused) resolving 'www.utrinski.mk/A/IN': 194.149.137.168#53
Oct 24 14:16:54 ip151 named[54864]: error (connection refused) resolving 'www.utrinski.mk/AAAA/IN': 194.149.137.168#53
Oct 24 14:16:59 ip151 named[54864]: validating @0x7f4e241324c0: www.biblioteksforeningen.org AAAA: no valid signature found
Oct 24 14:16:59 ip151 named[54864]: validating @0x7f4e0ccf4060: www.biblioteksforeningen.org A: no valid signature found
Oct 24 14:16:59 ip151 named[54864]: validating @0x7f4e0ccf4060: biblioteksforeningen.org A: no valid signature found
Oct 24 14:17:04 ip151 named[54864]: error (network unreachable) resolving 'dsac.cn/DS/IN': 2001:dc7::1#53
It seems like my server is spammed with name resolutions from unkown people. If I understood correctly, what I need to do is set up my server to be private in some sort.
I'm deeply sorry if I'm not using the correct terminology, I'm just trying to solve this thing quickly before it becomes a real problem for the sites I host.
Thank you
Update 1:
the result of -route ยง is :
Destination Next Hop Flag Met Ref Use If
[::]/96 [::] !n 1024 0 0 lo
0.0.0.0/96 [::] !n 1024 0 0 lo
2002:x00::/24 [::] !n 1024 0 0 lo
2002:xf00::/24 [::] !n 1024 0 0 lo
2002:x9fe::/32 [::] !n 1024 0 0 lo
2002:xc10::/28 [::] !n 1024 0 0 lo
2002:x0a8::/32 [::] !n 1024 0 0 lo
2002:x000::/19 [::] !n 1024 0 0 lo
3ffe:xfff::/32 [::] !n 1024 0 0 lo
[::]/0 [::] !n -1 113233992 lo
localhost/128 [::] Un 0 116069755 lo
ipxxx.ip-17x-3x-4x.eu/128 [::] Un 0 1 14444 lo
ff00::/8 [::] U 256 0 0 ens18
[::]/0 [::] !n -1 113233992 lo
UPDATE 2
I've simply modified the named.conf file with the following change (everything is clearly explained in the file, I should ahve looked there first)
options {
listen-on port 53 {
any;
};
// listen-on-v6 port 53 {
// any;
// };
I commented the last 3 lines, since I don't handle any IP V6 on my websites.
Also modified that line from yes to no :
`/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/`
recursion no;
It doesn't seem to impact any of my sites.
As a result, my logs now look like this :
Oct 24 15:10:57 ip151 named[40819]: client 127.0.0.1#58400 (www.dunyadinleri.com): query (cache) 'www.dunyadinleri.com/AAAA/IN' denied
Oct 24 15:10:57 ip151 named[40819]: client 127.0.0.1#58400 (www.dunyadinleri.com): query (cache) 'www.dunyadinleri.com/A/IN' denied
Oct 24 15:10:57 ip151 named[40819]: client 127.0.0.1#17750 (ujquery.org): query (cache) 'ujquery.org/A/IN' denied
Oct 24 15:10:57 ip151 named[40819]: client 127.0.0.1#17750 (ujquery.org): query (cache) 'ujquery.org/AAAA/IN' denied
Oct 24 15:10:57 ip151 named[40819]: client 127.0.0.1#58400 (adsl.aruba.it): query (cache) 'adsl.aruba.it/A/IN' denied
Oct 24 15:10:57 ip151 named[40819]: client 127.0.0.1#58400 (adsl.aruba.it): query (cache) 'adsl.aruba.it/AAAA/IN' denied
Oct 24 15:10:57 ip151 named[40819]: client 127.0.0.1#58400 (www.microscopy-uk.org.uk): query (cache) 'www.microscopy-uk.org.uk/A/IN' denied
Best Answer
Hmm, I see that it is happening for requests only coming from IPv6 source addresses. So I think your server is listening for requests on IPv6 address, But not able to reach or send them replies(network unreachable). And I am pretty sure that it may be happening due to absence of default gateway or a default route.
So check for following, run:
You should see something like
If there is no ::/0 route then this is the problem(absence of default route), Hence not able to send replies to IPv6 queries.
Update:
Well as i said there is no default route hence they are able to reach you but you are not. Again if you don't want these queries to come you have three options
Choose whichever option suites(as you said you are running a web server not DNS), Otherwise you are leaving your system very vulnerable!