{"id":1485,"date":"2020-12-21T06:26:39","date_gmt":"2020-12-21T06:26:39","guid":{"rendered":"http:\/\/blog.inetmar.com\/?p=1485"},"modified":"2024-07-29T14:31:13","modified_gmt":"2024-07-29T11:31:13","slug":"dns-amplificaiton-saldiri-opendns-resolver-engelleme","status":"publish","type":"post","link":"https:\/\/www.inetmar.com\/blog\/dns-amplificaiton-saldiri-opendns-resolver-engelleme\/","title":{"rendered":"DNS Amplificaiton sald\u0131r\u0131 – OpenDNS Resolver Engelleme"},"content":{"rendered":"\r\n

DNS Open-Resolver nedir?\u00a0<\/strong><\/h2>\r\n\r\n\r\n\r\n

DNS Open-resolver, Sunucunuzun internet \u00fczerinde farkl\u0131 kaynaklar\u0131n ger\u00e7ekle\u015ftirece\u011fi recursive query yani d\u0131\u015f sorgu i\u015flemlerine cevap vermesini sa\u011flayan bir yap\u0131d\u0131r.<\/p>\r\n\r\n\r\n\r\n

Neden Kapat\u0131lmal\u0131d\u0131r?<\/strong><\/h2>\r\n\r\n\r\n\r\n

Bilginiz d\u0131\u015f\u0131nda sunucular\u0131n 2. bir ki\u015fi taraf\u0131ndan kullan\u0131larak DDoS Reflection ad\u0131 verilen sald\u0131r\u0131larda kullan\u0131lmas\u0131na sebep olmaktad\u0131r.<\/p>\r\n\r\n\r\n\r\n

Sunucumda DNS Open-Resolver aktif midir?<\/strong><\/h2>\r\n\r\n\r\n\r\n

Sunucular\u0131n\u0131zda Open-Resolver yani DNS Recursion \u00f6zelli\u011finin aktif olup olmad\u0131\u011f\u0131n\u0131 tespit etmek i\u00e7in dig komutunu kullanabilirsiniz. Bu alanda g\u00f6sterece\u011fimiz b\u00fct\u00fcn komutlar Linux sunucular \u00fczerinden sa\u011flanmaktad\u0131r.<\/p>\r\n\r\n\r\n\r\n

\u00d6rnek Komut:\u00a0dig cert-bund.de @92.42.35.35<\/p>\r\n\r\n\r\n\r\n

Komu i\u015flendi\u011finde,<\/p>\r\n\r\n\r\n\r\n

\u00c7\u0131kt\u0131:<\/p>\r\n\r\n\r\n\r\n

;; global options: +cmd\r\n;; Got answer:\r\n;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 60398\r\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0<\/code><\/pre>\r\n\r\n\r\n\r\n
\u015eeklinde ise yani STATUS alan\u0131\u00a0REFUSED<\/strong>\u00a0ya da\u00a0SERVFAIL<\/strong>\u00a0\u015feklinde de\u011fil ise Sald\u0131r\u0131ya a\u00e7\u0131ks\u0131n\u0131z demektir.<\/p>\r\n\r\n\r\n\r\n
\"\"<\/a><\/p>\r\n
 <\/p>\r\n\r\n\r\n\r\n
E\u011fer komut \u00e7\u0131kt\u0131s\u0131;<\/p>\r\n\r\n\r\n\r\n
;; Got answer:\r\n;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 14200\r\n;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0\r\n;; WARNING: recursion requested but not available<\/code><\/pre>\r\n\r\n\r\n\r\n
\u015eeklinde ise yani status:\u00a0REFUSED<\/strong>\u00a0ya da\u00a0SERVFAIL<\/strong>\u00a0\u015feklinde ise problem olmad\u0131\u011f\u0131 ve g\u00fcvenli oldu\u011funuz anlam\u0131na gelir.<\/p>\r\n\r\n\r\n\r\n
\"\"<\/a><\/figure>\r\n\r\n\r\n\r\n
DNS Recursion \u00f6zelli\u011finin a\u00e7\u0131k olmas\u0131, “DNS Amplification Attack” grubundaki sald\u0131r\u0131lara maruz kalman\u0131za neden olmas\u0131n\u0131n yan\u0131 s\u0131ra Open-Resolver sald\u0131r\u0131lar\u0131nda rol oynaman\u0131z ile sonu\u00e7lan\u0131r ve sunucu network\u00fcn\u00fc sature ederek, network performans\u0131n\u0131n d\u00fc\u015fmesine neden olur.<\/p>\r\n\r\n\r\n\r\n
Ayn\u0131 zamanda sunucunuzdan a\u015f\u0131r\u0131 trafik \u00e7\u0131kmas\u0131na neden olaca\u011f\u0131 i\u00e7in, y\u00fcksek trafik maliyetleri kar\u015f\u0131n\u0131za \u00e7\u0131kabilir.<\/p>\r\n\r\n\r\n\r\n
Dns Recursion \u00f6zelli\u011fi nas\u0131l kapat\u0131l\u0131r?<\/p>\r\n\r\n\r\n\r\n
\u00d6nemli:<\/strong>\u00a0Sunucu y\u00f6netimi hakk\u0131nda bilgi sahibi de\u011filseniz, bu i\u015flemin teknik ekibimiz taraf\u0131ndan yap\u0131lmas\u0131 daha do\u011fru olacakt\u0131r. Taraf\u0131m\u0131za ticket sistemimiz \u00fczerinden sunucu \u015fifrelerinizi ileterek, dns recursion \u00f6zelli\u011finin kapat\u0131lmas\u0131n\u0131 talep edebilirsiniz.<\/p>\r\n\r\n\r\n\r\n
Bu soruya yan\u0131t bulabilmemiz i\u00e7in, \u00f6ncelikle hangi dns server yaz\u0131l\u0131m\u0131n\u0131 kulland\u0131\u011f\u0131m\u0131z\u0131 bilmeliyiz.<\/p>\r\n\r\n\r\n\r\n
Windows \u00fczerinde genellikle Microsof DNS yada Bind kullan\u0131l\u0131r. Linux \u00fczerinde ise genellikle Bind vard\u0131r.<\/p>\r\n\r\n\r\n\r\n
A\u015fa\u011f\u0131da bu versiyonar i\u00e7in dns recursion \u00f6zelli\u011fini kapatma y\u00f6ntemlerini ayr\u0131 ayr\u0131 anlataca\u011f\u0131z;<\/p>\r\n\r\n\r\n\r\n
1) Microsoft DNS \u00fczerinde, DNS Recursion \u00f6zelli\u011fini kapatma;<\/strong><\/h2>\r\n\r\n\r\n\r\n
https:\/\/technet.microsoft.com\/en-us\/library\/cc787602(v=ws.10).aspx<\/p>\r\n\r\n\r\n\r\n
Arama \u00e7ubu\u011funda “DNS” yaz\u0131p aratt\u0131\u011f\u0131m\u0131zda, Microsoft DNS servisi en \u00fcstte \u00e7\u0131kacakt\u0131r. Servisin y\u00f6netim aray\u00fcz\u00fc a\u00e7\u0131ld\u0131\u011f\u0131nda,
a\u015fa\u011f\u0131daki ekran g\u00f6r\u00fcnt\u00fcs\u00fcnde oldu\u011fu gibi, Dns Server isminin \u00fczerine sa\u011f t\u0131klay\u0131p, Properties alan\u0131na giriyoruz.<\/p>\r\n\r\n\r\n\r\n
\"\"<\/a><\/figure>\r\n\r\n\r\n\r\n
A\u00e7\u0131lan properties alan\u0131nda, “Advanced” sekmesini se\u00e7iyoruz ve “Disable rescursion” kutusunu\u00a0i\u015faretliyoruz<\/strong>.<\/p>\r\n\r\n\r\n\r\n
\"\"<\/a><\/figure>\r\n\r\n\r\n\r\n
Forwarders alan\u0131n\u0131n bo\u015f oldu\u011funa emin olmal\u0131y\u0131z.<\/p>\r\n\r\n\r\n\r\n
\"\"<\/a><\/figure>\r\n\r\n\r\n\r\n
Son olarak ta Root Hints alan\u0131n\u0131 tamamen bo\u015faltman\u0131z gerekmektedir.<\/p>\r\n\r\n\r\n\r\n
\"\"<\/a><\/p>\r\n
 <\/p>\r\n\r\n\r\n\r\n
Olmas\u0131 gereken;<\/p>\r\n\r\n\r\n\r\n
\"\"<\/a><\/figure>\r\n\r\n\r\n\r\n
Root Hints alan\u0131 i\u00e7in i\u015flemi tamamlad\u0131ktan sonra, DNS Servisini yeniden ba\u015flatmam\u0131z gerekiyor;<\/p>\r\n\r\n\r\n\r\n
\"\"<\/a><\/figure>\r\n\r\n\r\n\r\n
Bu i\u015flemlerden sonra sunucunuz \u00fczerindeki dns open resolver zafiyeti kapanm\u0131\u015f olacakt\u0131r.<\/p>\r\n\r\n\r\n\r\n
2) Windows Plesk Bind \u00fczerinde, DNS Recursion \u00f6zelli\u011fini kapatma;<\/strong><\/h2>\r\n\r\n\r\n\r\n
Bind Dns Servisinin kurulu oldu\u011fu yolu bulmal\u0131y\u0131z. Genellikle konfigurasyon dosyas\u0131 a\u015fa\u011f\u0131daki ekran g\u00f6r\u00fcnt\u00fcs\u00fcndeki konumdad\u0131r;<\/p>\r\n\r\n\r\n\r\n
\"\"<\/a><\/figure>\r\n\r\n\r\n\r\n
named.user.conf dosyas\u0131n\u0131 a\u00e7arak allow-recursion {…} yada recursion yes; gibi bir sat\u0131r varsa siliyoruz ve a\u015fa\u011f\u0131daki gibi d\u00fczeliyoruz;<\/p>\r\n\r\n\r\n\r\n
options{<\/p>\r\n\r\n\r\n\r\n
allow-transfer {none;};
additional-from-cache no;
recursion no;<\/p>\r\n\r\n\r\n\r\n
};<\/div>\r\n\r\n\r\n\r\n
\u00a0<\/div>\r\n\r\n\r\n\r\n
Gerekli d\u00fczenlemeyi yapt\u0131ktan sonra, DNS Servisini yeniden ba\u015flat\u0131yoruz.<\/div>\r\n\r\n\r\n\r\n
\"\"<\/a><\/figure>\r\n\r\n\r\n\r\n
\u00a0<\/div>\r\n\r\n\r\n\r\n
\u0130\u015flem bittikten sonra, mutlaka recursive \u00f6zelli\u011finin kapal\u0131 oldu\u011funu test etmelisiniz.<\/div>\r\n\r\n\r\n\r\n
\u00a0<\/div>\r\n\r\n\r\n\r\n
\r\n
3) Linux Bind \u00fczerinde, DNS Recursion \u00f6zelli\u011fini kapatmak;<\/strong><\/div>\r\n
\u00a0<\/div>\r\n
\u00d6ncelikle named.conf dosyam\u0131z\u0131, tercih etti\u011finiz text edit\u00f6r\u00fc ile a\u00e7\u0131yoruz.<\/div>\r\n
nano -w \/etc\/named.conf\r\n
 <\/p>\r\n
A\u015fa\u011f\u0131da g\u00f6rebilece\u011finiz gibi, recursive \u00f6zelli\u011fi a\u00e7\u0131k gelmi\u015f;<\/p>\r\n<\/div>\r\n
\"\"<\/a><\/figure>\r\n
\u00a0<\/div>\r\n
\r\n
recursion yes yada allow-recursion ile ilgili t\u00fcm sat\u0131rlar\u0131 siliyoruz yada \/\/ koyarak yorum sat\u0131r\u0131 haline getiriyoruz ve
a\u015fa\u011f\u0131daki sat\u0131r\u0131 ekliyoruz;<\/div>\r\n
allow-transfer {none;};
additional-from-cache no;
recursion no;<\/div>\r\n
\u00a0<\/div>\r\n
\"\"<\/a><\/figure>\r\n
\u00a0<\/div>\r\n
DNS servisini yeniden ba\u015flat\u0131yoruz.<\/div>\r\n
\"\"<\/a><\/figure>\r\n
\u00a0<\/div>\r\n<\/div>\r\n
ve tekrar test edip kapand\u0131\u011f\u0131na emin olman\u0131z yeterlidir.<\/div>\r\n
\r\n
\u00a0<\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n
com.tr domain<\/a> sahibi olmak i\u00e7in en uygun fiyat ve paket se\u00e7eneklerimizi inceleyin.<\/p>","protected":false},"excerpt":{"rendered":"
DNS Open-Resolver nedir?\u00a0 DNS Open-resolver, Sunucunuzun internet \u00fczerinde farkl\u0131 kaynaklar\u0131n ger\u00e7ekle\u015ftirece\u011fi recursive query yani d\u0131\u015f sorgu i\u015flemlerine cevap vermesini sa\u011flayan bir yap\u0131d\u0131r. Neden Kapat\u0131lmal\u0131d\u0131r? Bilginiz d\u0131\u015f\u0131nda sunucular\u0131n 2. bir ki\u015fi taraf\u0131ndan kullan\u0131larak DDoS Reflection ad\u0131...<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[57,11,46,48],"tags":[],"class_list":["post-1485","post","type-post","status-publish","format-standard","hentry","category-dns","category-linux","category-sunucu","category-win-server"],"_links":{"self":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts\/1485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/comments?post=1485"}],"version-history":[{"count":12,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts\/1485\/revisions"}],"predecessor-version":[{"id":9719,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts\/1485\/revisions\/9719"}],"wp:attachment":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/media?parent=1485"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/categories?post=1485"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/tags?post=1485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}