Bind, DNS, and Denial of Service

[John Von Essen]

Thanks... Right now I have a FreeBSD 9.3 system, after a clean install I went in and built Bind99 from ports with the RRL option.

Question is how do I force /etc/rc.d/named to use the new bind9.9 that I built from ports and now resides in /usr/local/sbin?

Do I just edit /etc/defaults/rc.conf and tell it to use /usr/local/sbin/named instead of /usr/sbin/named?

I thought there might be a cleaner way to do this, just curious.

-John

-----Original Message-----
From: Chris H [mailto:bsd-lists at bsdforge.com] 
Sent: Tuesday, December 02, 2014 9:18 PM
To: freebsd-hackers at freebsd.org; John Von Essen
Subject: Re: Bind, DNS, and Denial of Service

On Tue, 2 Dec 2014 19:00:06 -0500 "John Von Essen" <john at quonix.net> wrote

> I figure this might be the best place to start this discussion.
> 
>  
> 
> I've been using FreeBSD for ages for some core systems, one of those 
> being Auth and public caching DNS.
> 
>  
> 
> Lately I've been getting hit hard by reflective DDoS on DNS, so my old 
> systems need some updating.
> 
>  
> 
> Question is, what's the best/simplest solution moving forward? FreeBSD 
> 9.3 or 10.1? Do I continue to use BIND with the rate-limiting feature, 
> or go with something else?
> 
>  
> 
> I will say, I tried to get a FreeBSD 10.1 instance running with BIND 
> 10 - no luck, so I did BIND 9.9 with the RRL feature. It sort of 
> worked, but was weird. I was getting a ton of weird responses on the 
> server the moment I turned BIND on.
> 
>  
> 
> Its been so long since I've worked on this stuff, my old 8.X machines 
> have been running for years.
> 
>  
> 
> I am open to using something else for the caching, but for the Auth I 
> really want to stay with Bind. Its just really hard to implement BIND 
> with RRL on newer freebsd distro's, I get the feeling that the FreeBSD 
> folks want to move on from BIND.
> 
>  
> 
> Any help would be appreciated.

Hello, John.

FWIW You might find dns/nsd a good fit. It's even possible to get it to output "Bind like" log messages. I've replaced the Bind on all, but one of our servers with it. In an effort to evaluate it for being a replacement. I'm finding it difficult to keep the last server still running the Bind going.
So I'll probably have to replace it with something soon. Just haven't *yet* determined *what* other DNS to evaluate. I only ran into one issue with it (NSD). It was NSD itself, and the reaction time is extremely good (less than a week), and a new
(fixed) version was out.

Anyway. Just thought I'd share my experience. In case it helps.

--Chris

> 
>  
> 
> -John
> 
>  
> 
>  
> 
> _______________________________________________
> freebsd-hackers at freebsd.org mailing list 
> http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
> To unsubscribe, send any mail to "freebsd-hackers-unsubscribe at freebsd.org"