[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    Re: News DoS using sendsys
From:       Don Lewis <Don.Lewis () TSC ! TDK ! COM>
Date:       1998-08-27 23:05:51
[Download RAW message or body]

On Aug 27,  9:32am, David Shaw wrote:
} Subject: Re: News DoS using sendsys
} On Wed, Aug 26, 1998 at 03:52:58PM -0700, Russ Allbery wrote:
} > There are several possible solutions at different levels of complexity.
} >
} > First, please make sure that your control.ctl file or the equivalent has a
} > line like:
} >
} >         sendsys:*:*:drop
}
} While you're at it, it might be worth adding:
}
}         senduuname:*:*:drop
}         version:*:*:drop
}
} I suspect that once everyone configures their server to stop responding to
} sendsys, the bombers will switch to senduuname and version.  I have
} already seen a hundred "version" requests come in.  Neither version nor
} senduuname are relevant to the overwhelming majority of INN installations
} out there.

Yup, they've already switched.  There's still a lot of overhead even if
you configure "drop".  Here's something that I found in news.admin.technical
that is relevant for INN users:

> From: raoul@shell1.tiac.net (Nico Garcia)
> Subject: Re: System bogs during sendsys bomb attacks
> Approved: scott@zorch.SF-Bay.ORG
> Sender: scott@zorch.SF-Bay.ORG (Scott Hazen Mueller)
> Organization: The Internet Access Company
> Message-ID: <6r8cum$dtf@news-central.tiac.net>
> References: <6r6ir7$c6g$1@canoe.xcski.com>
> Date: Mon, 17 Aug 1998 05:38:28 GMT
> Lines: 19
>
> In article <6r6ir7$c6g$1@canoe.xcski.com>,
> Paul Tomblin <ptomblin@xcski.com> wrote:
> >I'm running stock INN 1.7.2, and every time I get a batch of HIPCRIME sendsys
> >bombs, my load average breifly goes up through the roof.  This is in spite of
> >the fact that I have it set to drop sendsys in control.ctl.  I seem to have a
> >copy of /var/lib/newsbin/control/sendsys running for each message.  Is there a
> >tweak I can do somewhere to reduce the priority on these things.  I thought
> >they were run out of ctlrun, but that doesn't appear to be the case.
>
> "echo exit >/var/lib/newsbin/control/sendsys"
>
> That won't prevent the processes but it will shorten the hell out
> of their execution time.
>
> --
>                                 Nico Kadel-Garcia, ne' Garcia
>                                 raoul@tiac.net

[prev in list] [next in list] [prev in thread] [next in thread]