github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Replacing word of caution with big fat warning and commenting out named-refused-udp completely (Closes: #583364)

debian-releases/squeeze
Yaroslav Halchenko 2010-06-28 21:45:47 -04:00
parent d1b9e71173
commit 833f60a38a
1 changed files with 14 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
debian/jail.conf vendored
View File

@ -262,17 +262,20 @@ logpath = /var/log/mail.log
# #
# in your named.conf to provide proper logging # in your named.conf to provide proper logging
# Word of Caution: # !!! WARNING !!!
# Given filter can lead to DoS attack against your DNS server # Since UDP is connectionless protocol, spoofing of IP and immitation
# since there is no way to assure that UDP packets come from the # of illegal actions is way too simple. Thus enabling of this filter
# real source IP # might provide an easy way for implementing a DoS against a chosen
[named-refused-udp] # victim. See
# http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
enabled = false # Please DO NOT USE this jail unless you know what you are doing.
port = domain,953 #[named-refused-udp]
protocol = udp #
filter = named-refused #enabled = false
logpath = /var/log/named/security.log #port = domain,953
#protocol = udp
#filter = named-refused
#logpath = /var/log/named/security.log
[named-refused-tcp] [named-refused-tcp]