Bind 9 Mitigating DNS based attack using Iptables

bind-mitingating-denying-hosts.sh

#!/bin/bash
#
# Written for an old bind without rate-limiting feature 
#

LOG_WINDOW=1000
SECURITY_LOG=/var/log/named/security.log
IPTABLES_CHAIN=INPUT
DENIED_LIMIT=10

IPLIST=$(tail -$LOG_WINDOW $SECURITY_LOG | grep denied | awk '{ print $4 }' | sed 's/#.*//' | sort | uniq)

BLOCKING=$(iptables -L INPUT -n | tail -n+3 | wc -l)

echo -e "\nBlocking $BLOCKING IPs\n" 
echo "" 


for IP in $IPLIST; do
  if $(iptables -L $IPTABLES_CHAIN -n | grep -q $IP) ; then
    echo "[ ] $IP already blocked"
else
  OCCURRENCIES=$(grep $IP $SECURITY_LOG | wc -l)
  if [ $OCCURRENCIES -gt $DENIED_LIMIT ]; then
    if iptables -A $IPTABLES_CHAIN -s $IP -j DROP; then
      echo "[+] $IP added to blocked IPs"
    else
      echo "[!] ERROR adding $IP to IpTables!"
    fi
  else
    echo "[?] $IP denied $OCCURRENCIES times, not over the maximum limit of $DENIED_LIMIT"
  fi
fi
done

named.conf.logging

logging {

  channel default_file { file "/var/log/named/default.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel general_file { file "/var/log/named/general.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel database_file { file "/var/log/named/database.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel security_file { file "/var/log/named/security.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel config_file { file "/var/log/named/config.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel resolver_file { file "/var/log/named/resolver.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel xfer-in_file { file "/var/log/named/xfer-in.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel xfer-out_file { file "/var/log/named/xfer-out.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel notify_file { file "/var/log/named/notify.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel client_file { file "/var/log/named/client.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel unmatched_file { file "/var/log/named/unmatched.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel queries_file { file "/var/log/named/queries.log" versions 3 size 80m; severity dynamic; print-time yes; };
  channel network_file { file "/var/log/named/network.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel update_file { file "/var/log/named/update.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel dispatch_file { file "/var/log/named/dispatch.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel dnssec_file { file "/var/log/named/dnssec.log" versions 3 size 5m; severity dynamic; print-time yes; };
  channel lame-servers_file { file "/var/log/named/lame-servers.log" versions 3 size 5m; severity dynamic; print-time yes; };

  category default { default_file; };
  category general { general_file; };
  category database { database_file; };
  category security { security_file; };
  category config { config_file; };
  category resolver { resolver_file; };
  category xfer-in { xfer-in_file; };
  category xfer-out { xfer-out_file; };
  category notify { notify_file; };
  category client { client_file; };
  category unmatched { unmatched_file; };
  category queries { queries_file; };
  category network { network_file; };
  category update { update_file; };
  category dispatch { dispatch_file; };
  category dnssec { dnssec_file; };
  category lame-servers { lame-servers_file; };

};