Difference between revisions of "Atomicrbl"
m |
m (→Local DNS mirror) |
||
| Line 94: | Line 94: | ||
= Local DNS mirror = | = Local DNS mirror = | ||
| + | |||
| + | == rbldnsd == | ||
| + | |||
| + | We provide our zones in rbldnsd format. rbldnsd is a lightweight, fast DNS server designed for RBLs. From the [http://www.corpit.ru/mjt/rbldnsd.html rbldnsds project homepage]: | ||
| + | |||
| + | ''rbldnsd is a small and fast DNS daemon which is especially made to serve DNSBL zones. This daemon was inspired by Dan J. Bernstein's rbldns program found in the djbdns package. | ||
| + | |||
| + | rbldnsd is extremely fast - it outperforms both bind and djbdns greatly. It has very small memory footprint. | ||
| + | |||
| + | The daemon can serve both IP-based (ordb.org, dsbl.org etc) and name-based (rfc-ignorant.org) blocklists. Unlike DJB's rbldns, it has ability to specify individual values for every entry, can serve as many zones on a single IP address as you wish, and, finally, it is a real nameserver: it can reply to DNS metadata requests. The daemon keeps all zones in memory for faster operations, but its memory usage is very efficient, especially for repeated TXT values which are stored only once.'' | ||
== Requesting Access == | == Requesting Access == | ||
Revision as of 17:24, 10 December 2014
Contents |
Introduction
The Atomicorp RBLs are part of the Atomicorp Threat Intelligence system. It provides information about potential sources of malicious activity that can be used to detect potential malicious activity from a source using DNS RBLs.
Enabling
Atomic Secured Linux ASL
To enable the TI in ASL just enable this setting:
https://www.atomicorp.com/wiki/index.php/ASL_WAF#MODSEC_00_THREAT
Looking up Addresses
DNS
To look up an address on the Atomicorp Threat Intelligence via DNS the format is:
invertedIP.zone.atomicrbl.com
For example, if the IP is 127.0.0.2, and you wanted to check the "test" zone, you would look up the address in this format:
2.0.0.127.test.atomicrbl.com
Web
Web access is available at the URL below:
http://www.atomicrbl.com/lookup
Zones
test.atomicrbl.com
This is a test zone. It is not used by ASL to block anything (in fact its not even used by ASL). This zone exists solely so users can test to see if DNS resolution is working to the zone. There is only one address in the zone.
alert6
This zone is informational only. It is not used by ASL to block anything, it just records sources that have triggered a level 6 or higher event from systems running Atomicorp products.
scammers
This zone is informational only. It is not used by ASL to block anything, it just records sources that have a history of malicious behavior.
Theat 1 (TI-1)
Zone file: threat1.rbl
This zone contains sources that are currently launching DOS attacks. This zone is used in ASL, and sources on this RBL will have their traffic dropped by default. Shunning will not occur, by default, for these sources as that can induce additional load on the attacked system. Dropping traffic is the lowest effort method.
Please see this article for additional information: WAF 350051
Threat 2 (TI-2)
Zone file: threat2.rbl
This zone contains sources that have been detected spamming. This zone is used in ASL, and sources on this RBL will have their traffic dropped by default. Shunning will not occur, by default, for these sources as that can induce additional load on the attacked system. Dropping traffic is the lowest effort method.
Please see this article for additional information: WAF 350052
Threat 3 (TI-3)
Zone file: threat3.rbl
This zone contains sources that have been detected carrying out brute force attacks (e.g. password guessing). This zone is used in ASL, and sources on this RBL will have their traffic shunned by default.
Please see this article for additional information: WAF 350053
Threat 4 (TI-4)
Zone file: threat4.rbl
This zone contains sources that have been detected carrying out attacks. This zone is used in ASL, and sources on this RBL will have their traffic shunned by default.
Please see this article for additional information: WAF 355504
Threat 5 (TI-5)
This zone contains sources that have been detected carrying out either attacks or a lot of suspicious activity that when combined means the source is attacking the destination. This zone is used in ASL, and sources on this RBL will have their traffic shunned by default.
Please see this article for additional information: WAF 355506
Threat 6 (TI-6)
This zone is currently informational only. It is not used by ASL to block anything, it just contains sources that have caused multiple firewall block events.
It may be used in ASL in the future.
Threat 7 (TI-7)
This zone is currently informational only. It is not used by ASL to block anything.
It may be used in ASL in the future.
Local DNS mirror
rbldnsd
We provide our zones in rbldnsd format. rbldnsd is a lightweight, fast DNS server designed for RBLs. From the rbldnsds project homepage:
rbldnsd is a small and fast DNS daemon which is especially made to serve DNSBL zones. This daemon was inspired by Dan J. Bernstein's rbldns program found in the djbdns package.
rbldnsd is extremely fast - it outperforms both bind and djbdns greatly. It has very small memory footprint.
The daemon can serve both IP-based (ordb.org, dsbl.org etc) and name-based (rfc-ignorant.org) blocklists. Unlike DJB's rbldns, it has ability to specify individual values for every entry, can serve as many zones on a single IP address as you wish, and, finally, it is a real nameserver: it can reply to DNS metadata requests. The daemon keeps all zones in memory for faster operations, but its memory usage is very efficient, especially for repeated TXT values which are stored only once.
Requesting Access
Access to the zones, for local DNS mirroring, is restricted. To request access, please send an email to support. We will need to know the IP address(es) of the systems that will be requesting access, and will ask you to sign an confidentiality agreement to access the zones.
Access is restricted to existing customers only.
Local Only Resolver
Software Installation
Note: These instructions are for Redhat and Centos based systems, please other operating systems contact your OS vendor for instructions for installing rbldnsd on your system, or if you need assistance from us please let us know and we'll put a quote together for your system.
Step 1)
yum -y install rbldnsd
Note: rbldnsd is not provided by Atomicorp.
Step 2) Configure rbldnsd
For a local resolver, all you need to do is add this single line to your /etc/sysconfig/rbldnsd file:
RBLDNSD="dsbl -u rbldnsd -b127.0.0.01/750 -a -v -f -c60 -r/home/rbldnsd/zones threat1.atomicrbl.com:ip4set:threat1.rbl atomicrbl.com:generic:atomicrbl.com threat2.atomicrbl.com:ip4set:threat2.rbl threat3.atomicrbl.com:ip4set:threat3.rbl threat4.atomicrbl.com:ip4set:threat4.rbl threat5.atomicrbl.com:ip4set:threat5.rbl test.atomicrbl.com:ip4set:test.atomicrbl.com"
By default, in Redhat and Centos, everything else should be commented out in this configuration file. If its not, comment it out, you will only need this line in that file.
Step 3) create the rbldnsd user
useradd rbldnsd
Step 4) create the zone directory
mkdir /home/rbldnsd/zones
Download the zones
Step 1) Request access
See the top of this document for access. Access to the zones, for local DNS mirroring, is restricted and is restricted to existing customers only.
Step 2) Use rsync to download the zones
Note: Do not run this more often than hourly at this time.
rsync -azv rsync.atomicrbl.com::atomicrbl/* /home/rbldnsd/zones
Note: Our zones are formated for rbldnsd, an fast and low memory footprint DNS server designed for RBLs.
Step 3) Start rbldnsd
/etc/init.d/rbldnsd start
Step 4) Configure your DNS server to forward to rbldnsd for atomicrbl.com
For bind, add this to your /etc/named.conf file:
zone "atomicrbl.com" {
type forward;
forward first;
forwarders {
127.0.0.1 port 750;
};
};
Step 5) Restart named/bind
/etc/init.d/named restart
Step 6) Test resolution
nslookup 2.0.0.127.test.atomicrbl.com
If you have things setup correctly to use a local resolver on your system, you should see this:
Server: 127.0.0.1 Address: 127.0.0.1#53 Non-authoritative answer: Name: 2.0.0.127.test.atomicrbl.com Address: 127.0.0.1
Remote Resolver
These instructions are for organizations that want to provide a copy of the zones to their local systems, without installing local copies on those systems.
Note: Do not run a public remote resolver. If you would like to run a public resolver, please let us know, theres some additional software you will need.
Software Installation
Note: These instructions are for Redhat and Centos based systems, please other operating systems contact your OS vendor for instructions for installing rbldnsd on your system, or if you need assistance from us please let us know and we'll put a quote together for your system.
Step 1)
yum -y install rbldnsd
Note: rbldnsd is not provided by Atomicorp.
Step 2) Configure rbldnsd
For a local resolver, all you need to do is add this single line to your /etc/sysconfig/rbldnsd file, and you must change the IP address 1.2.3.4 to your servers IP address:
RBLDNSD="dsbl -u rbldnsd -b1.2.3.4 -a -v -f -c60 -r/home/rbldnsd/chroot -w zones threat1.atomicrbl.com:ip4set:threat1.rbl atomicrbl.com:generic:atomicrbl.com threat2.atomicrbl.com:ip4set:threat2.rbl threat3.atomicrbl.com:ip4set:threat3.rbl threat4.atomicrbl.com:ip4set:threat4.rbl threat5.atomicrbl.com:ip4set:threat5.rbl test.atomicrbl.com:ip4set:test.atomicrbl.com threat6.atomicrbl.com:ip4set:threat6.rbl threat7.atomicrbl.com:ip4set:threat7.rbl alert6.atomicrbl.com:ip4set:alert6.rbl -l +/logs/rbldnsd.log -s /logs/rbldnsd_stats"
By default, in Redhat and Centos, everything else should be commented out in this configuration file. If its not, comment it out, you will only need this line in that file.
Step 3) create the rbldnsd user
useradd rbldnsd
Step 4) create the rbldnsd directories
mkdir /home/rbldnsd/chroot
mkdir /home/rbldnsd/chroot/logs
mkdir /home/rbldnsd/chroot/zones
Download the zones
Step 1) Request access
See the top of this document for access. Access to the zones, for local DNS mirroring, is restricted and is restricted to existing customers only.
Step 2) Use rsync to download the zones
Note: Do not run this more often than hourly at this time.
rsync -azv rsync.atomicrbl.com::atomicrbl/* /home/rbldnsd/chroot/zones
Note: Our zones are formated for rbldnsd, an fast and low memory footprint DNS server designed for RBLs.
Step 3) Start rbldnsd
/etc/init.d/rbldnsd start
Step 4) Test resolution
nslookup 2.0.0.127.test.atomicrbl.com
If you have things setup correctly to use a local resolver on your system, you should see this:
Server: 127.0.0.1 Address: 127.0.0.1#53 Non-authoritative answer: Name: 2.0.0.127.test.atomicrbl.com Address: 127.0.0.1
Step 5) Setup logrotation for the resolution logs
Add this file:
/home/rbldnsd/chroot/logs/*.log {
rotate 30
daily
compress
missingok
notifempty
create 0644 rbldnsd rbldnsd
sharedscripts
prerotate
/sbin/service rbldnsd stop
endscript
postrotate
/sbin/service rbldnsd start
endscript
}
To this directory:
/etc/logrotate.d
