{"id":791,"date":"2020-08-07T12:24:05","date_gmt":"2020-08-07T12:24:05","guid":{"rendered":"https:\/\/blog.sh.com.tr\/?p=791"},"modified":"2021-04-08T17:48:52","modified_gmt":"2021-04-08T17:48:52","slug":"dns-recursion-ozelligini-kapatmak","status":"publish","type":"post","link":"https:\/\/sh.com.tr\/blog\/dns-recursion-ozelligini-kapatmak\/","title":{"rendered":"Dns recursion \u00f6zelli\u011fini kapatmak"},"content":{"rendered":"

OpenDNS Resolver ve Devre d\u0131\u015f\u0131 b\u0131rakmak<\/strong><\/p>\n

D\u0130KKAT: Recursive DNS kapal\u0131 olsa bile, root servers ve forwarder servers ekli oldu\u011fu s\u00fcrece, sunucu DNS Amplificaiton sald\u0131r\u0131 kayna\u011f\u0131 olacakt\u0131r. Bu nedenle sadece recursive dns’i kapatman\u0131z yeterli de\u011fildir. L\u00fctfen a\u015fa\u011f\u0131daki makalede belirtildi\u011fi gibi, root ve forwarder b\u00f6l\u00fcmlerini de siliniz.
\nDNS Open-Resolver nedir?
\nDNS Open-resolver, Sunucunuzun internet \u00fczerinde farkl\u0131 kaynaklar\u0131n ger\u00e7ekle\u015ftirece\u011fi recursive query yani d\u0131\u015f sorgu i\u015flemlerine cevap vermesini sa\u011flayan bir yap\u0131d\u0131r.
\nNeden Kapat\u0131lmal\u0131d\u0131r?
\nBilginiz d\u0131\u015f\u0131nda sunucular\u0131n 2. bir ki\u015fi taraf\u0131ndan kullan\u0131larak DDoS Reflection ad\u0131 verilen sald\u0131r\u0131larda kullan\u0131lmas\u0131na sebep olmaktad\u0131r.
\nSunucumda DNS Open-Resolver aktif midir?
\nSunucular\u0131n\u0131zda Open-Resolver yani DNS Recursion \u00f6zelli\u011finin aktif olup olmad\u0131\u011f\u0131n\u0131 tespit etmek i\u00e7in dig komutunu kullanabilirsiniz. Bu alanda g\u00f6sterece\u011fimiz b\u00fct\u00fcn komutlar Linux sunucular \u00fczerinden sa\u011flanmaktad\u0131r.
\nNOT: S terminali \u00fczerinde sadece IP adresi yazman\u0131z yeterlidir.
\n\u00d6rnek Komut: dig cert-bund.de @77.92.152.2
\n\u00c7\u0131kt\u0131s\u0131:<\/p>\n

\"\"<\/p>\n

\u015eeklinde ise yani status:\u00a0REFUSED<\/strong>\u00a0ya da\u00a0SERVFAIL<\/strong> \u015feklinde ise problem olmad\u0131\u011f\u0131 ve g\u00fcvenli oldu\u011funuz anlam\u0131na gelir.<\/p>\n

\"\"<\/p>\n

DNS Recursion \u00f6zelli\u011finin a\u00e7\u0131k olmas\u0131, “DNS Amplification Attack” grubundaki sald\u0131r\u0131lara maruz kalman\u0131za neden olmas\u0131n\u0131n yan\u0131 s\u0131ra Open-Resolver sald\u0131r\u0131lar\u0131nda rol oynaman\u0131z ile sonu\u00e7lan\u0131r ve sunucu network\u00fcn\u00fc sature ederek, network performans\u0131n\u0131n d\u00fc\u015fmesine neden olur.<\/p>\n

Ayn\u0131 zamanda sunucunuzdan a\u015f\u0131r\u0131 trafik \u00e7\u0131kmas\u0131na neden olaca\u011f\u0131 i\u00e7in, y\u00fcksek trafik maliyetleri kar\u015f\u0131n\u0131za \u00e7\u0131kabilir.<\/p>\n

Dns Recursion \u00f6zelli\u011fi nas\u0131l kapat\u0131l\u0131r?<\/p>\n

\u00d6nemli:<\/strong>\u00a0Sunucu y\u00f6netimi hakk\u0131nda bilgi sahibi de\u011filseniz, bu i\u015flemin teknik ekibimiz taraf\u0131ndan yap\u0131lmas\u0131 daha do\u011fru olacakt\u0131r. E-destek sistemimiz \u00fczerinden sunucu \u015fifrelerinizi ileterek, dns recursion \u00f6zelli\u011finin kapat\u0131lmas\u0131n\u0131 talep edebilirsiniz.<\/p>\n

Bu soruya yan\u0131t bulabilmemiz i\u00e7in, \u00f6ncelikle hangi dns server yaz\u0131l\u0131m\u0131n\u0131 kulland\u0131\u011f\u0131m\u0131z\u0131 bilmeliyiz.<\/p>\n

Windows \u00fczerinde genellikle Microsof DNS yada Bind kullan\u0131l\u0131r. Linux \u00fczerinde ise genellikle Bind vard\u0131r.<\/p>\n

A\u015fa\u011f\u0131da bu versiyonar i\u00e7in dns recursion \u00f6zelli\u011fini kapatma y\u00f6ntemlerini ayr\u0131 ayr\u0131 anlataca\u011f\u0131z;<\/p>\n

1) Microsoft DNS \u00fczerinde, DNS Recursion \u00f6zelli\u011fini kapatma;<\/strong><\/p>\n

http:\/\/technet.microsoft.com\/en-us\/library\/cc787602(v=ws.10).aspx<\/p>\n

Arama \u00e7ubu\u011funda “DNS” yaz\u0131p aratt\u0131\u011f\u0131m\u0131zda, Microsoft DNS servisi en \u00fcstte \u00e7\u0131kacakt\u0131r. Servisin y\u00f6netim aray\u00fcz\u00fc a\u00e7\u0131ld\u0131\u011f\u0131nda,
\na\u015fa\u011f\u0131daki ekran g\u00f6r\u00fcnt\u00fcs\u00fcnde oldu\u011fu gibi, Dns Server isminin \u00fczerine sa\u011f t\u0131klay\u0131p, Properties alan\u0131na giriyoruz.<\/p>\n

\"\"<\/p>\n

A\u00e7\u0131lan properties alan\u0131nda, “Advanced” sekmesini se\u00e7iyoruz ve “Disable rescursion” kutusunu\u00a0i\u015faretliyoruz<\/strong>.<\/p>\n

\"\"<\/p>\n

Forwarders alan\u0131n\u0131n bo\u015f oldu\u011funa emin olmal\u0131y\u0131z.<\/p>\n

\"\"<\/p>\n

Son olarak ta Root Hints alan\u0131n\u0131 tamamen bo\u015faltman\u0131z gerekmektedir.<\/p>\n

\"\"<\/p>\n

Olmas\u0131 gereken;<\/p>\n

\"\"<\/p>\n

Root Hints alan\u0131 i\u00e7in i\u015flemi tamamlad\u0131ktan sonra, DNS Servisini yeniden ba\u015flatmam\u0131z gerekiyor;<\/p>\n

\"\"<\/p>\n

 <\/p>\n

\u0130\u015flem bittikten sonra, mutlaka recursive \u00f6zelli\u011finin kapal\u0131 oldu\u011funu test etmelisiniz, a\u015fa\u011f\u0131da test y\u00f6ntemleri ayr\u0131ca anlat\u0131lacakt\u0131r.<\/p>\n

2) Windows Plesk Bind \u00fczerinde, DNS Recursion \u00f6zelli\u011fini kapatma;<\/strong><\/p>\n

Bind Dns Servisinin kurulu oldu\u011fu yolu bulmal\u0131y\u0131z. Genellikle konfigurasyon dosyas\u0131 a\u015fa\u011f\u0131daki ekran g\u00f6r\u00fcnt\u00fcs\u00fcndeki konumdad\u0131r;<\/p>\n

\"\"<\/p>\n

named.user.conf dosyas\u0131n\u0131 a\u00e7arak allow-recursion {…} yada recursion yes; gibi bir sat\u0131r varsa siliyoruz ve a\u015fa\u011f\u0131daki gibi d\u00fczeliyoruz;<\/p>\n

options{
\nallow-transfer {none;};
\nadditional-from-cache no;
\nrecursion no;<\/p>\n

};<\/p>\n

Gerekli d\u00fczenlemeyi yapt\u0131ktan sonra, DNS Servisini yeniden ba\u015flat\u0131yoruz.<\/p>\n

\"\"<\/p>\n

\u0130\u015flem bittikten sonra, mutlaka recursive \u00f6zelli\u011finin kapal\u0131 oldu\u011funu test etmelisiniz, a\u015fa\u011f\u0131da test y\u00f6ntemleri ayr\u0131ca anlat\u0131lacakt\u0131r.<\/p>\n

3) Linux Bind \u00fczerinde, DNS Recursion \u00f6zelli\u011fini kapatmak;<\/strong><\/p>\n

\u00d6ncelikle named.conf dosyam\u0131z\u0131, tercih etti\u011finiz text edit\u00f6r\u00fc ile a\u00e7\u0131yoruz.<\/p>\n

nano -w \/etc\/named.conf<\/p>\n

A\u015fa\u011f\u0131da g\u00f6rebilece\u011finiz gibi, recursive \u00f6zelli\u011fi a\u00e7\u0131k gelmi\u015f;<\/p>\n

\"\"<\/p>\n

recursion yes yada allow-recursion ile ilgili t\u00fcm sat\u0131rlar\u0131 siliyoruz yada \/\/ koyarak yorum sat\u0131r\u0131 haline getiriyoruz ve
\na\u015fa\u011f\u0131daki sat\u0131r\u0131 ekliyoruz;<\/p>\n

allow-transfer {none;};
\nadditional-from-cache no;
\nrecursion no;<\/p>\n

\"\"<\/p>\n

DNS Recursion \u00f6zelli\u011finin a\u00e7\u0131k olup olmad\u0131\u011f\u0131n\u0131 nas\u0131l test edebiliriz?<\/strong><\/p>\n

Sunucunuzun IP Adresini;<\/p>\n

https:\/\/ping.sh.com.tr\/dns.php<\/a>\u00a0adresi \u00fczerinden aratarak DIG sorgusu \u00e7al\u0131\u015ft\u0131rabilir ve cevab\u0131n\u0131 g\u00f6zlemleyebilirsiniz.<\/p>\n

\"\"<\/p>\n

Linux sunucu \u00fczerinden test etme;<\/strong><\/p>\n

Linux sunucularda “dig” komutu ile DNS Recursion \u00f6zelli\u011fini test edebiliriz. A\u015fa\u011f\u0131daki komut
\n“78.135.65.30” ip adresine “google.com nerede bar\u0131nmaktad\u0131r?” sorusunu g\u00f6nderiyor.
\nBu soruya “Status:REFUSED\u00a0<\/strong>ya da\u00a0SERVFAIL\u00a0<\/strong>yan\u0131t\u0131 al\u0131rsak DNS Recursion \u00f6zelli\u011fi kapal\u0131 demektir,
\n“Status:NOERROR” yan\u0131t\u0131 al\u0131rsak, DNS Recursion \u00f6zelli\u011fi a\u00e7\u0131k demektir ve derhal bu \u00f6zellik kapat\u0131lmal\u0131d\u0131r.<\/p>\n

\"\"<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

OpenDNS Resolver ve Devre d\u0131\u015f\u0131 b\u0131rakmak D\u0130KKAT: Recursive DNS kapal\u0131 olsa bile, root servers ve forwarder servers ekli oldu\u011fu s\u00fcrece, sunucu DNS Amplificaiton sald\u0131r\u0131 kayna\u011f\u0131 olacakt\u0131r. Bu nedenle sadece recursive dns’i kapatman\u0131z yeterli de\u011fildir. L\u00fctfen a\u015fa\u011f\u0131daki makalede belirtildi\u011fi gibi, root ve forwarder b\u00f6l\u00fcmlerini de siliniz. DNS Open-Resolver nedir? DNS Open-resolver, Sunucunuzun internet \u00fczerinde farkl\u0131 kaynaklar\u0131n […]<\/p>\n","protected":false},"author":3,"featured_media":792,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30],"tags":[79,78],"class_list":["post-791","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bilgi-bankasi","tag-dns-recursion","tag-dns-recursion-ozelligini-kapatmak"],"_links":{"self":[{"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/posts\/791","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=791"}],"version-history":[{"count":0,"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/posts\/791\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/media\/792"}],"wp:attachment":[{"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=791"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=791"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=791"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}