From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: Re: [PATCH v4 1/3] Unbound: Enable DNS cache poisoning mitigation Date: Mon, 10 Sep 2018 16:35:49 +0100 Message-ID: In-Reply-To: <20180910142126.5265-1-peter.mueller@link38.eu> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4145633614523684085==" List-Id: --===============4145633614523684085== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Merged! On Mon, 2018-09-10 at 16:21 +0200, Peter Müller wrote: > By default, Unbound neither keeps track of the number of unwanted > replies nor initiates countermeasures if they become too large (DNS > cache poisoning). > > This sets the maximum number of tolerated unwanted replies to > 1M, causing the cache to be flushed afterwards. (Upstream documentation > recommends 10M as a threshold, but this turned out to be ineffective > against attacks in the wild.) > > See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for > details. This version of the patch uses 1M as threshold instead of > 5M and supersedes the first and second version. > > Signed-off-by: Peter Müller > --- > config/unbound/unbound.conf | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf > index 3f724d8f7..ce9ddcd62 100644 > --- a/config/unbound/unbound.conf > +++ b/config/unbound/unbound.conf > @@ -61,6 +61,9 @@ server: > harden-algo-downgrade: no > use-caps-for-id: no > > + # Harden against DNS cache poisoning > + unwanted-reply-threshold: 1000000 > + > # Listen on all interfaces > interface-automatic: yes > interface: 0.0.0.0 --===============4145633614523684085==--