Site icon KerKer 的模組世界

DNS伺服器查詢日誌設定(Bind9)

&NewLine;<p class&equals;"wp-block-paragraph">邊做邊學,順便留個筆記,若有錯誤請不吝指教。 <&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">有時防火牆抓到有主機在查詢已知的惡意Domain,一看主機IP居然是自家的DNS Server頭就開始痛, 鬼知道是誰在再透過自家的DNS Server亂搞,這個時候就有必要在DNS Server上建立查詢日誌了&lpar;query log&rpar;。<&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<&excl;--more-->&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">我們這邊以Bind9為例,首先要修改的是named&period;conf檔案,並在logging段中加入內容如下:<&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<pre class&equals;"wp-block-code"><code>logging &lbrace;&NewLine; category queries &lbrace; query-log&semi;&rcub;&semi;&NewLine; channel query-log &lbrace;&NewLine; file "&sol;var&sol;log&sol;query&period;log" versions 10 size 1000m&semi;&NewLine; severity info&semi;&NewLine; print-time yes&semi;&NewLine; print-severity yes&semi;&NewLine; print-category yes&semi;&NewLine; &rcub;&semi;&NewLine;&rcub;&semi;<&sol;code><&sol;pre>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">其中file位址可以自行修改至喜歡的位置,而1000m為log檔大小,也可以依據需求自行調整。<&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">完成設定後記得重啟DNS服務:<&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<pre class&equals;"wp-block-code"><code>service named restart<&sol;code><&sol;pre>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">先隨意查詢一個domain後使用cat指令確認是否成功紀錄:<&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<pre class&equals;"wp-block-code"><code>cat &sol;var&sol;log&sol;query&period;log<&sol;code><&sol;pre>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">Log紀錄應該要包含:日期、時間、查詢者IP、查詢的Domain等資訊,配合grep指令可以快速查找到需要的資料。<&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">這樣一來你就可以輕鬆的揪出是誰在查詢惡意domain了!當然也可以用來查是誰在用公司電腦上怪怪的網站A&lowbar;&lowbar;&lowbar;A!<&sol;p>&NewLine;

Exit mobile version