From 833f60a38a4e457b33c8206cf2cad5bc3cd788aa Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 28 Jun 2010 21:45:47 -0400 Subject: [PATCH] Replacing word of caution with big fat warning and commenting out named-refused-udp completely (Closes: #583364) --- debian/jail.conf | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/debian/jail.conf b/debian/jail.conf index ef4c7438..931db9af 100644 --- a/debian/jail.conf +++ b/debian/jail.conf @@ -262,17 +262,20 @@ logpath = /var/log/mail.log # # in your named.conf to provide proper logging -# Word of Caution: -# Given filter can lead to DoS attack against your DNS server -# since there is no way to assure that UDP packets come from the -# real source IP -[named-refused-udp] - -enabled = false -port = domain,953 -protocol = udp -filter = named-refused -logpath = /var/log/named/security.log +# !!! WARNING !!! +# Since UDP is connectionless protocol, spoofing of IP and immitation +# of illegal actions is way too simple. Thus enabling of this filter +# might provide an easy way for implementing a DoS against a chosen +# victim. See +# http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html +# Please DO NOT USE this jail unless you know what you are doing. +#[named-refused-udp] +# +#enabled = false +#port = domain,953 +#protocol = udp +#filter = named-refused +#logpath = /var/log/named/security.log [named-refused-tcp]