Re: /var partition overflow (due to spyware?) in FreeBSD default install

• Previous message: Brett Glass: "Re: Best way to filter "Nachi pings"?"
• In reply to: Brett Glass: "/var partition overflow (due to spyware?) in FreeBSD default install"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Tue, 28 Oct 2003 06:29:56 -0600
To: Brett Glass <brett@lariat.org>

Brett Glass wrote:
> All:
>
> I'm posting this to FreeBSD-security (rather than FreeBSD-net) because
> the problems I'm seeing appear to have been caused by spyware, and
> because they constitute a possible avenue for denial of service on
> FreeBSD machines with default installs of the operating system.
>
> Several of the FreeBSD machines on our network began to act strangely
> during the past week. Some have started to refuse mail; in other cases,
> important daemons have died without warning. All of the machines are
> running 4.x releases of FreeBSD with all recent patches installed, and
> all are running the version of BIND supplied with FreeBSD. The "top"
> command, when run on these machines, showed that BIND is consuming very
> large amounts of CPU time, but this by itself couldn't explain all of
> the symptoms we were seeing.
>
> This afternoon, I examined the machines and discovered the problem: full
> /var partitions caused by huge /var/log/messages files.
>
> Inspection of the files reveals hundreds of thousands of messages of the
> form:
>
> Oct 23 16:00:07 victim named[326]: sysquery: no addrs found for root NS
> (ns0.opennic.glue)
> Oct 23 16:00:07 victim named[326]: sysquery: no addrs found for root NS
> (ns1.opennic.glue)
> Oct 23 16:00:07 victim named[326]: sysquery: no addrs found for root NS
> (ns3.opennic.glue)
> Oct 23 16:00:07 victim named[326]: sysquery: no addrs found for root NS
> (ns4.opennic.glue)
> Oct 23 16:00:07 victim named[326]: sysquery: no addrs found for root NS
> (ns6.opennic.glue)
> Oct 23 16:00:07 victim named[326]: sysquery: no addrs found for root NS
> (ns7.opennic.glue)
> Oct 23 16:00:07 victim named[326]: sysquery: no addrs found for root NS
> (ns8.opennic.glue)
> Oct 23 16:00:07 victim named[326]: sysquery: no addrs found for root NS
> (ns11.opennic.glue)
> Oct 23 16:00:07 victim named[326]: sysquery: no addrs found for root NS
> (ns10.opennic.glue)
> Oct 23 16:00:07 victim named[326]: sysquery: no addrs found for root NS
> (ns11.opennic.glue)
>
> The references to OpenNIC have caused me to suspect (though I have not
> verified it yet) that the problem is due to the New.Net spyware, which
> causes Windows machines to query OpenNIC's name servers. From what I've
> read so far, it appears that New.Net is "foistware" -- that is, it can
> be installed on innocent users' Windows machines without their consent
> via holes in Internet Explorer. But if New.Net is not what's
> responsible, SOMETHING certainly seems to be generating bogus DNS
> queries, which in turn are causing these messages.
>
> FreeBSD currently comes configured, in the default install, to check
> /var/messages only once a day, and to rotate the log file if it's above
> a certain size. Unfortunately, these messages accumulate so rapidly that
> this is not sufficient; the /var partition in the default install can
> easily be overflowed long before the log is rotated, causing
> malfunctions. I've temporarily changed /etc/crontab so that newsyslog is
> run every 5 minutes instead of once a day (which may be a good idea to
> prevent other denials of service via this sort of overflow as well). But
> it also makes sense to patch the system so that it does not fill so many
> verbose messages -- and/or to ignore the bogus queries generated by the
> spyware. It may also pay to patch BIND to limit the overhead that is
> incurred when such queries occur. Ideas?
>

Wouldn't a better work-around be either add ns*.opennic.glue addresses
to named.root or setup a dummy zone for .glue that just returns a
localhost address to the client?

Or a possible solution would be to setup bind to log directly to its own
log files and rotate them when needed and turn off logging to syslog.

Bind8&9 allow for logging of various messages to different files and
letting bind rotate them when needed. Check out the Bind documention.
There is a helpful example available at:
http://logreport.org/doc/gen/dns/bind8.php

Here's a quick example from bind9:
# This setups logging options
# general info is logged to both syslog and a local file
# info about lame-servers is sent to /dev/null
logging {
         channel named_log {
         file "/var/named/named.log" versions 5 size 1m;
         severity info;
         print-time yes;
         };

         channel null {
         null;
         };

category "default" { "named_log"; default_syslog; };
category "lame-servers" { "null"; };
};

I guess as an improvement on the default named.conf, it could include an
example section on logging options.

greg

_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

• Previous message: Brett Glass: "Re: Best way to filter "Nachi pings"?"
• In reply to: Brett Glass: "/var partition overflow (due to spyware?) in FreeBSD default install"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]