Revision as of 11:57, 11 December 2014

Introduction

The Atomicorp RBLs are part of the Atomicorp Threat Intelligence system. It provides information about potential sources of malicious activity that can be used to detect potential malicious activity from a source using DNS RBLs.

Enabling

Atomic Secured Linux ASL

To enable the TI in ASL just enable this setting:

https://www.atomicorp.com/wiki/index.php/ASL_WAF#MODSEC_00_THREAT

Looking up Addresses

DNS

To look up an address on the Atomicorp Threat Intelligence via DNS the format is:

invertedIP.zone.atomicrbl.com

For example, if the IP is 127.0.0.2, and you wanted to check the "test" zone, you would look up the address in this format:

2.0.0.127.test.atomicrbl.com

Web

Web access is available at the URL below:

http://www.atomicrbl.com/lookup

Terms

If you are using the Atomicorp Threat Intelligence system to filter traffic to your system you need to know whether you qualify for free use or not.

Free Use is satisfactory for private systems with low traffic, but server administrators are responsible for ensuring their servers remain constantly below the free use limits. Professional Use provides a completely different and dependable level of service, using your choice of either private dedicated servers, rsync data delivery direct to your network, or integration into ASL.

Caution: If your usage should exceed the free use terms your access to the public DNS servers is very likely to be cut off without warning.

Free Use

Atomicorp serves billions of DNS queries to the world every day, free of charge, from its public servers. This free public DNS service is sustained and backed financially by Atomicorp. To qualify for the free Atomocorp DNS query service, server operators must ensure they meet the criteria for free use.

Use of the RBLs via DNS queries to our public DNS servers is free of charge if you meet all three of the following criteria:

Your use of the Atomicorp DNS RBLs is non-commercial*, and
Your web traffic is less than 100,000 HTTP connections per day, and
Your RBL query volume is less than 300,000 queries per day.

If you do not fit all three of these criteria then please do not use our public DNSBL servers, instead see 'Commercial Use'.

"non-commercial use" is use for any purpose other than as part or all of a product or service that is resold, or for use of which a fee is charged. For example, using our RBLs in a commercial filtering appliance that is then sold to others requires a feed license, regardless of use volume. The same is true of commercial filtering software and commercial filtering services.

If you are in any doubt as to whether you fit within our free use criteria, or think you may be likely to soon exceed our free use criteria, please switch to 'Commercial Use'.

Atomicorp monitors use of its public DNS servers to identify installations exceeding the free use criteria in order to prevent a minority of heavy users from degrading the quality of the service to all other users of our free public DNS servers.

Commercial Use

ASL

Use of the Atomicorp Threat Intelligence system is included in active ASL licenses.

ASL Reverse Proxy

Use of the Atomicorp Threat Intelligence system is included in active ASL Reverse Proxy licenses.

DNS Use

Use of the Atomicorp RBLS by organizations and networks with traffic likely to exceed the Free Use limits, or by ISPs or commercial filter services, requires a subscription to the Atomicorp RBL Datafeed Service, a service designed for users with professional requirements.

This service provides two options of commercial use: RBL Query Service or the Rsync Service. Both of these deliver fast realtime responses for your servers and is both backed with support and a service contract.

If unsure, you can try either Service free for 30 days before deciding to subscribe to it. For more information contact sales@atomicorp.com.

Zones

test.atomicrbl.com

This is a test zone. It is not used by ASL to block anything (in fact its not even used by ASL). This zone exists solely so users can test to see if DNS resolution is working to the zone. There is only one address in the zone.

alert6

This zone is informational only. It is not used by ASL to block anything, it just records sources that have triggered a level 6 or higher event from systems running Atomicorp products.

scammers

This zone is informational only. It is not used by ASL to block anything, it just records sources that have a history of malicious behavior.

Theat 1 (TI-1)

Zone file: threat1.rbl

This zone contains sources that are currently launching DOS attacks. This zone is used in ASL, and sources on this RBL will have their traffic dropped by default. Shunning will not occur, by default, for these sources as that can induce additional load on the attacked system. Dropping traffic is the lowest effort method.

Please see this article for additional information: WAF 350051

Threat 2 (TI-2)

Zone file: threat2.rbl

This zone contains sources that have been detected spamming. This zone is used in ASL, and sources on this RBL will have their traffic dropped by default. Shunning will not occur, by default, for these sources as that can induce additional load on the attacked system. Dropping traffic is the lowest effort method.

Please see this article for additional information: WAF 350052

Threat 3 (TI-3)

Zone file: threat3.rbl

This zone contains sources that have been detected carrying out brute force attacks (e.g. password guessing). This zone is used in ASL, and sources on this RBL will have their traffic shunned by default.

Please see this article for additional information: WAF 350053

Threat 4 (TI-4)

Zone file: threat4.rbl

This zone contains sources that have been detected carrying out attacks. This zone is used in ASL, and sources on this RBL will have their traffic shunned by default.

Please see this article for additional information: WAF 355504

Threat 5 (TI-5)

This zone contains sources that have been detected carrying out either attacks or a lot of suspicious activity that when combined means the source is attacking the destination. This zone is used in ASL, and sources on this RBL will have their traffic shunned by default.

Please see this article for additional information: WAF 355506

Threat 6 (TI-6)

This zone is currently informational only. It is not used by ASL to block anything, it just contains sources that have caused multiple firewall block events.

It may be used in ASL in the future.

Threat 7 (TI-7)

This zone is currently informational only. It is not used by ASL to block anything.

It may be used in ASL in the future.

Local DNS mirror

rbldnsd

We provide our zones in rbldnsd format. rbldnsd is a lightweight, fast DNS server designed for RBLs. From the rbldnsds project homepage:

rbldnsd is a small and fast DNS daemon which is especially made to serve DNSBL zones. This daemon was inspired by Dan J. Bernstein's rbldns program found in the djbdns package.

rbldnsd is extremely fast - it outperforms both bind and djbdns greatly. It has very small memory footprint.

The daemon can serve both IP-based (ordb.org, dsbl.org etc) and name-based (rfc-ignorant.org) blocklists. Unlike DJB's rbldns, it has ability to specify individual values for every entry, can serve as many zones on a single IP address as you wish, and, finally, it is a real nameserver: it can reply to DNS metadata requests. The daemon keeps all zones in memory for faster operations, but its memory usage is very efficient, especially for repeated TXT values which are stored only once.

Requesting Access

Access to the zones, for local DNS mirroring, is restricted. To request access, please send an email to support. We will need to know the IP address(es) of the systems that will be requesting access, and will ask you to sign an confidentiality agreement to access the zones.

Access is restricted to existing customers only.

Local Only Resolver

Software Installation

Note: These instructions are for Redhat and Centos based systems, please other operating systems contact your OS vendor for instructions for installing rbldnsd on your system, or if you need assistance from us please let us know and we'll put a quote together for your system.

Step 1)

yum -y install rbldnsd

Note: rbldnsd is not provided by Atomicorp.

Step 2) Configure rbldnsd

For a local resolver, all you need to do is add this single line to your /etc/sysconfig/rbldnsd file:

RBLDNSD="dsbl -u rbldnsd -b127.0.0.01/750 -a -v -f -c60 -r/home/rbldnsd/zones threat1.atomicrbl.com:ip4set:threat1.rbl atomicrbl.com:generic:atomicrbl.com threat2.atomicrbl.com:ip4set:threat2.rbl threat3.atomicrbl.com:ip4set:threat3.rbl threat4.atomicrbl.com:ip4set:threat4.rbl threat5.atomicrbl.com:ip4set:threat5.rbl test.atomicrbl.com:ip4set:test.atomicrbl.com"

By default, in Redhat and Centos, everything else should be commented out in this configuration file. If its not, comment it out, you will only need this line in that file.

Step 3) create the rbldnsd user

useradd rbldnsd

Step 4) create the zone directory

mkdir /home/rbldnsd/zones

Download the zones

Step 1) Request access

See the top of this document for access. Access to the zones, for local DNS mirroring, is restricted and is restricted to existing customers only.

Step 2) Use rsync to download the zones

Note: Do not run this more often than hourly at this time.

rsync -azv rsync.atomicrbl.com::atomicrbl/* /home/rbldnsd/zones

Note: Our zones are formated for rbldnsd, an fast and low memory footprint DNS server designed for RBLs.

Step 3) Start rbldnsd

/etc/init.d/rbldnsd start

Configuring

This allows you to continue to use bind on your system, and rbldnsd in parallel for the RBL lookups.

Step 4) Configure your DNS server to forward to rbldnsd for atomicrbl.com

For bind, add this to your /etc/named.conf file:

zone "atomicrbl.com" {

       type forward;
       forward first;
       forwarders {
       127.0.0.1 port 750;
       };

};

Step 5) Restart named/bind

/etc/init.d/named restart

Step 6) Test resolution

nslookup 2.0.0.127.test.atomicrbl.com

If you have things setup correctly to use a local resolver on your system, you should see this:

Server:		127.0.0.1
Address:	127.0.0.1#53

Non-authoritative answer:
Name:	2.0.0.127.test.atomicrbl.com
Address: 127.0.0.1

Remote Resolver

These instructions are for organizations that want to provide a copy of the zones to their local systems, without installing local copies on those systems.

Note: Do not run a public remote resolver. If you would like to run a public resolver, please let us know, theres some additional software you will need.

Software Installation

Note: These instructions are for Redhat and Centos based systems, please other operating systems contact your OS vendor for instructions for installing rbldnsd on your system, or if you need assistance from us please let us know and we'll put a quote together for your system.

Step 1)

yum -y install rbldnsd

Note: rbldnsd is not provided by Atomicorp.

Step 2) Configure rbldnsd

For a local resolver, all you need to do is add this single line to your /etc/sysconfig/rbldnsd file, and you must change the IP address 1.2.3.4 to your servers IP address:

RBLDNSD="dsbl -u rbldnsd -b1.2.3.4 -a -v -f -c60 -r/home/rbldnsd/chroot -w zones threat1.atomicrbl.com:ip4set:threat1.rbl atomicrbl.com:generic:atomicrbl.com threat2.atomicrbl.com:ip4set:threat2.rbl threat3.atomicrbl.com:ip4set:threat3.rbl threat4.atomicrbl.com:ip4set:threat4.rbl threat5.atomicrbl.com:ip4set:threat5.rbl test.atomicrbl.com:ip4set:test.atomicrbl.com threat6.atomicrbl.com:ip4set:threat6.rbl threat7.atomicrbl.com:ip4set:threat7.rbl alert6.atomicrbl.com:ip4set:alert6.rbl -l +/logs/rbldnsd.log -s /logs/rbldnsd_stats"

By default, in Redhat and Centos, everything else should be commented out in this configuration file. If its not, comment it out, you will only need this line in that file.

Step 3) create the rbldnsd user

useradd rbldnsd

Step 4) create the rbldnsd directories

mkdir /home/rbldnsd/chroot

mkdir /home/rbldnsd/chroot/logs

mkdir /home/rbldnsd/chroot/zones

Download the zones

Step 1) Request access

See the top of this document for access. Access to the zones, for local DNS mirroring, is restricted and is restricted to existing customers only.

Step 2) Use rsync to download the zones

Note: Do not run this more often than hourly at this time.

rsync -azv rsync.atomicrbl.com::atomicrbl/* /home/rbldnsd/chroot/zones

Note: Our zones are formated for rbldnsd, an fast and low memory footprint DNS server designed for RBLs.

Step 3) Start rbldnsd

/etc/init.d/rbldnsd start

Step 4) Test resolution

nslookup 2.0.0.127.test.atomicrbl.com

If you have things setup correctly to use a local resolver on your system, you should see this:

Server:		127.0.0.1
Address:	127.0.0.1#53

Non-authoritative answer:
Name:	2.0.0.127.test.atomicrbl.com
Address: 127.0.0.1

Step 5) Setup logrotation for the resolution logs

Add this file:

/home/rbldnsd/chroot/logs/*.log {
    rotate 30
    daily
    compress
    missingok
    notifempty
    create 0644 rbldnsd rbldnsd
    sharedscripts
    prerotate
	/sbin/service rbldnsd stop
    endscript
    postrotate
	/sbin/service rbldnsd start
    endscript
}

To this directory:

/etc/logrotate.d

@@ Line 28: / Line 28: @@
 http://www.atomicrbl.com/lookup
+=== Terms ===
+If you are using the Atomicorp Threat Intelligence system to filter traffic to your system you need to know whether you qualify for free use or not.
+Free Use is satisfactory for private systems with low traffic, but server administrators are responsible for ensuring their servers remain constantly below the free use limits. Professional Use provides a completely different and dependable level of service, using your choice of either private dedicated servers, rsync data delivery direct to your network, or integration into ASL.
+Caution: If your usage should exceed the free use terms your access to the public DNS servers is very likely to be cut off without warning.
+====Free Use====
+Atomicorp serves billions of DNS queries to the world every day, free of charge, from its public servers. This free public DNS service is sustained and backed financially by Atomicorp. To qualify for the free Atomocorp DNS query service, server operators must ensure they meet the criteria for free use.
+Use of the RBLs via DNS queries to our public DNS servers is free of charge if you meet all three of the following criteria:
+# Your use of the Atomicorp DNS RBLs is non-commercial*, and
+# Your web traffic is less than 100,000 HTTP connections per day, and
+# Your RBL query volume is less than 300,000 queries per day.
+If you do not fit all three of these criteria then please do not use our public DNSBL servers, instead see 'Commercial Use'.
+"non-commercial use" is use for any purpose other than as part or all of a product or service that is resold, or for use of which a fee is charged. For example, using our RBLs in a commercial filtering appliance that is then sold to others requires a feed license, regardless of use volume. The same is true of commercial filtering software and commercial filtering services.
+If you are in any doubt as to whether you fit within our free use criteria, or think you may be likely to soon exceed our free use criteria, please switch to 'Commercial Use'.
+Atomicorp monitors use of its public DNS servers to identify installations exceeding the free use criteria in order to prevent a minority of heavy users from degrading the quality of the service to all other users of our free public DNS servers.
+====Commercial Use====
+===== ASL =====
+Use of the Atomicorp Threat Intelligence system is included in active ASL licenses.
+===== ASL Reverse Proxy =====
+Use of the Atomicorp Threat Intelligence system is included in active ASL Reverse Proxy licenses.
+===== DNS Use =====
+Use of the Atomicorp RBLS by organizations and networks with traffic likely to exceed the Free Use limits, or by ISPs or commercial filter services, requires a subscription to the Atomicorp RBL Datafeed Service, a service designed for users with professional requirements.
+This service provides two options of commercial use: RBL Query Service or the Rsync Service.  Both of these deliver fast realtime responses for your servers and is both backed with support and a service contract.
+If unsure, you can try either Service free for 30 days before deciding to subscribe to it. For more information contact sales@atomicorp.com.
 = Zones =

Difference between revisions of "Atomicrbl"

Revision as of 11:57, 11 December 2014

Contents

Introduction

Enabling

Atomic Secured Linux ASL

Looking up Addresses

DNS

Web

Terms

Free Use

Commercial Use

ASL

ASL Reverse Proxy

DNS Use

Zones

test.atomicrbl.com

alert6

scammers

Theat 1 (TI-1)

Threat 2 (TI-2)

Threat 3 (TI-3)

Threat 4 (TI-4)

Threat 5 (TI-5)

Threat 6 (TI-6)

Threat 7 (TI-7)

Local DNS mirror

rbldnsd

Requesting Access

Local Only Resolver

Software Installation

Download the zones

Configuring

Remote Resolver

Software Installation

Download the zones

Views

Personal tools

Navigation

Search

Toolbox