<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(51,51,255)">If all of this is new to you install webmin (but don't allow it outside of your firewall):<a href="http://www.webmin.com/">http://www.webmin.com/</a></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div>-- JD Austin<br>Voice: 480.269.4335 (480 2MY Geek)<br><a href="mailto:jd@twingeckos.com" target="_blank">jd@twingeckos.com</a></div><br></div></div></div>
<br><div class="gmail_quote">On Mon, Dec 8, 2014 at 10:11 AM, Keith Smith <span dir="ltr"><<a href="mailto:techlists@phpcoderusa.com" target="_blank">techlists@phpcoderusa.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
Sorry guys. I should have given more info.<br>
<br>
I'm a LAMP developer. I am increasingly doing more sys admin stuff. I home office. I have a Cox business account that allows me to run a server. I bought a Dell i5 / 8GB RAM for this project. I have never configured BIND or any email server. It is my goal to do so. One LAMP+Dind+Mail server in my home office.<br>
<br>
I installed CentOS 7 on the Dell and am hoping to use this project to learn how to mange a server from top to bottom. I have no problem configuring a LAMP server. It is Bind and Postfix+Dovecott+Spamassassin+<u></u>MySql that I need help with.<br>
<br>
I figure by running my own server I will learn a lot and round out my skills.<br>
<br>
So that is my project......<br>
<br>
Thank you so much for your help!! I'm sure I will have lots of questions along the way.<br>
<br>
Keith<div><div class="h5"><br>
<br>
<br>
<br>
<br>
On 2014-12-08 10:40, der.hans wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
Am 08. Dez, 2014 schwätzte Michael Butash so:<br>
<br>
moin moin,<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 12/07/2014 10:42 PM, der.hans wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Am 07. Dez, 2014 schwätzte Michael Butash so:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
You'll want to allow tcp/53 if doing any sort of public dns - anything greater than 1500 bytes (ie most domain-keys//spf records), and also any<br>
</blockquote>
<br>
True, if you're doing those things, you might have large dns payloads and<br>
need tcp. If you think they cause problems rather than fixing them, then<br>
...<br>
</blockquote>
"Normal" use of these yes, but imho better just to leave it be serviced anyways, especially if any sort of provider for others.<br>
</blockquote>
<br>
Yeah, I suppose I pre-optimized and presumed this would be home, non 3rd<br>
party use for Keith.<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
anomaly mitigation gear (the things that keep 400gb DDoS at bay) use that to<br>
</blockquote>
<br>
What would anomaly mitigation gear be doing to cause large dns payloads?<br>
That's a serious question as I don't even know what anomaly mitigation<br>
gear is.<br>
</blockquote>
It's not a large payload issue, it's a method of them validating who is a script opening a raw udp socket to spew junk, etc vs. a "real" RFC-compliant client by sending that truncate bit back to the client, making them request via tcp, and thus doing something more than legit aiming a cannon.<br>
</blockquote>
<br>
Hmm, this isn't making sense to me. Are you saying a client makes a<br>
request to your dns service and you force the client over to tcp lookups?<br>
If so, does that cause the rest of the recursive lookup to other servers<br>
to be tcp as well?<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Having worked for one of those large hosting companies that gets those 300gb ddos attacks you read about (not to mention being responsible for dealing with them), you need something to do mitigate botnet blasts automagically,<br>
</blockquote>
<br>
Most of our protocols could use some updates.<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
and luckily some smart people figure out protocol challenge behavioral hacks to do that. I remember back in 2003 needing to open firewalls to allow tcp for our dns just for that alone when ddos became vogue among warring customers, but became more common at various other businesses to have to address allowing tcp as well for spf and others.<br>
<br>
It also broke some remote providers that blocked tcp/53 as well for some reason when our devices couldn't "validate" them, adding them to a drop list vs. whitelisting them as "valid" clients.<br>
</blockquote>
<br>
Did those remote providers block tcp/53 for client or just for server (<br>
only incoming syn blocks )?<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Not that big a deal running a server at your house, and never using dkim/spf. I think most default cisco asa firewall configs still filter udp dns protocol traffic by default over 512 too.<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
figure our if you're real or not. Blocking tcp for dns is not a good idea as a whole, it's just RFC-compliant behavior things expect.<br>
</blockquote>
<br>
As I recall, the RFC only specifies tcp for large payloads. Don't allow<br>
them and tcp isn't necessary.<br>
</blockquote>
Less is more I suppose when talking firewalls, just know when you *do* need things like tcp-based dns.<br>
</blockquote>
<br>
Yeah, good thing for Keith that you're pointing out that a service<br>
provider probably has to leave tcp/53 exposed, especially when using newer<br>
dns record 'features'.<br>
<br>
ciao,<br>
<br>
der.hans<br></div></div><span class="">
------------------------------<u></u>---------------------<br>
PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org" target="_blank">PLUG-discuss@lists.phxlinux.<u></u>org</a><br>
To subscribe, unsubscribe, or to change your mail settings:<br>
<a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss" target="_blank">http://lists.phxlinux.org/<u></u>mailman/listinfo/plug-discuss</a><br>
</span></blockquote><span class="HOEnZb"><font color="#888888">
<br>
-- <br>
Keith Smith</font></span><div class="HOEnZb"><div class="h5"><br>
------------------------------<u></u>---------------------<br>
PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org" target="_blank">PLUG-discuss@lists.phxlinux.<u></u>org</a><br>
To subscribe, unsubscribe, or to change your mail settings:<br>
<a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss" target="_blank">http://lists.phxlinux.org/<u></u>mailman/listinfo/plug-discuss</a></div></div></blockquote></div><br></div>