[Samba] DNS amplification attacks

[Marc Muehlfeld]

Hello Bruno,

Am 25.02.2014 19:31, schrieb Bruno Vane:
> How can I configure samba4 to be protected against DNS amplification
> attacks? Is there a way to set the network I want it to be recursive,
> like in bind9?

Have you tried 'allow-recursion' in BIND? If this doesn't work, I guess 
it's not supported (yet) in combination with the DLZ module.



> My samba4 is receiving attacks and googling I found this:
> http://dnsamplificationattacks.blogspot.com.br/2014/02/domain-gerdar3ru.html

But do you really want your DC listening on your internet NIC and 
provide DNS and other Samba services to internet users?

If not, you can tell Samba to listen only on the other interfaces. See
https://wiki.samba.org/index.php/Samba_port_usage#Prevent_Samba_from_listening_on_all_interfaces


If your DNS should be accessable from the internet and you want to 
manage the zones via AD, then I would recommend that you place an 
additional machine with BIND in your DMZ, that is forwarding the 
requests, you want to allow, to your DC.


Regards,
Marc