Score:0

Is it worth it to install and configure fail2ban for an Bind9 authoritative DNS server?

cn flag

In our project infrastructure we have a nameserver, based on bind9. This nameserver is configured as primary and authoritative, so it is quite important. The question is, should I install and configure fail2ban for the purpose of protecting this DNS server? Is it worth it? I tried searching fail2ban configurations for Bind9/named, but there are only a few, and it seems like it is not something that people do (at least post) much.

If it makes any difference, Bind9 is running in a docker container with exposed 53/udp port.

in flag
What would the point be if it is a public service? (also UDP can be spoofed, but remember that DNS uses both UDP and TCP) If the primary DNS is critical then keep it internal only and only expose a slave. also add at least one of-site slave. (You can get free ones at he.net and afraid.org)
hancack avatar
cn flag
@NiKiZe thank you for a great suggestion about exposing slaves only! And regarding the point of fail2ban installation, I thought that maybe it will add some strength to the server by blocking suspicious IP addresses or something.
Patrick Mevzek avatar
cn flag
Define "suspicious" :-) There is little tools really tailored for DNS so it is often a bad idea to put things in front of a DNS server. There are 2 paths you can follow: look at bind RRL feature, which is rate limiting, and for really powerful needs look at `dnsdist` which sits in front on nameservers and allows fine control of traffic.
hancack avatar
cn flag
@PatrickMevzek I guess some client, trying to make an excessive amount of requests to the server, could fall under a category "suspicious", I don't know :) Currently project is just starting, so I guess it would be okay to leave bind as it is without any additional protection. Thanks for your reply, I will definitely take a look at tools you mentioned!
djdomi avatar
za flag
i basically created a new rule for the spam, you may tske a look at my github repository https://github.com/djdomi/fail2ban-rules
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.