From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter =?utf-8?q?M=C3=BCller?= To: development@lists.ipfire.org Subject: [PATCH 1/3 v2] Unbound: Enable DNS cache poisoning mitigation Date: Sun, 26 Aug 2018 20:34:09 +0200 Message-ID: <58ca41ec-0a1a-68bd-1042-e8268926b807@link38.eu> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2988000817833756317==" List-Id: --===============2988000817833756317== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit By default, Unbound neither keeps track of the number of unwanted replies nor initiates countermeasures if they become too large (DNS cache poisoning). This sets the maximum number of tolerated unwanted replies to 1M, causing the cache to be flushed afterwards. (Upstream documentation recommends 10M as a threshold, but this turned out to be ineffective against attacks in the wild.) See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for details. This version of the patch uses 1M as threshold instead of 5M and supersedes the first version. Signed-off-by: Peter Müller --- config/unbound/unbound.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf index 3f724d8f7..fa2ca3fd4 100644 --- a/config/unbound/unbound.conf +++ b/config/unbound/unbound.conf @@ -61,6 +61,9 @@ server: harden-algo-downgrade: no use-caps-for-id: no + # Harden against DNS cache poisoning + unwanted-reply-threshold: 1000000 + # Listen on all interfaces interface-automatic: yes interface: 0.0.0.0 -- 2.16.4 --===============2988000817833756317== Content-Type: application/pgp-signature Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="signature.asc" MIME-Version: 1.0 LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KCmlRSXpCQUVCQ2dBZEZpRUV2UDRTaUdoRVlE SnlyUkxrMlVqeUQzMTduMmdGQWx1QzhxZ0FDZ2tRMlVqeUQzMTcKbjJnS09RLy9RRXNGQmVnd1Jx VHczSnhCZExiT2hVRnJudkE5Qk1oMzBDNVRMWU92SExzaXVZZlhHcjRhVXRUWgp6Qkx3MnB2eStJ VWhnajFDQ2ZpS1VMNG9IRnF6YUhSZm5vTHVUdEJpa2doY1dtMGtxa015ak5uMUJRaUNaeTkzCjIx UFJnWlNmelc2ekh5U0FHbHQ5cC9pblZVdHB5MTlDdDdYVWhKaHo4VmJ1YmUrQXVuOXZIblplWFZG MUtSUlEKbk1ZMVp3RnEwdk5oVGlCVEFhTzZLVEdCVmdvQnN6MFM3dlJHdS9wUUtvT3FmU09ZZnpl aXhkZFhQcktVM2I1SQpJdjVJUEJaRStPTU5kSFV0U0JNVWZxSVB3Q2VjcjZFekVRVFI0Tm9OK1M1 Y0lEMEdhOWNOOUtKK2xOaEZNbytECjhxRzRmdUo5MWV6cFR6TVhDSkVwRVNBWnk3SkQvQTJmWkF2 VTBWQUNXVmdrTWdlbnZSYndlVTZUS2h1Rk9xVXYKYi92U0tHaEwrc2pOeWVtdU1zT2J1cjMwSVpO TmozZXJMRmxLYzlaSEozeEt5Z1NQVHpHQnVQZkpmcGVranptVApqTDAxNEltNjZEdXRPbTd5Y1gz WExKc3Y3YTNCaXpZbGU3ZU96a1pGNTlKTTV1a1g2a0JoUXdBWkY4SHBYYW5yCm1iK3RoZzdwbXRh eFZRdGhUcC9WSkZwd3dkMFRmUnZxUllUcDVKRGNQSVJUSEZuRTk4Nk9YSmxQTEQ4V2RJQ3EKbERn QXVVbjBNK25rTTBKUnFwNXhkc2JVcVFRWXZxZXhKUW1HSFl0ajlPQ2x0WkNYbjBaNnFBQWV1ZGMw c2FEKwpWTDBRME5SYWRQRmxhYi9LazU3bEwyQVJMUWxXZ1B4eU1Za0VxMWJEb09pc0pMV2F3d0k9 Cj1QSVJ3Ci0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo= --===============2988000817833756317==--