Another way to reduce the amount of network abuse on your OpenVZ VPS nodes (in addition to Nodewatch) is to scan them for recursive DNS resolvers which are often the target for DNS Amplification DoS attacks.
This script scans all OpenVZ containers on a node for open DNS resolvers:
#!/bin/bash
echo "Simple script to scan all OpenVZ containers for open DNS resolvers"
echo "For web-based testing use http://openresolver.com"
for ip in `vzlist -H | awk '{print $4}'`;
do
OUT=$(dig +short +tries=1 +time=2 test.openresolver.com TXT @$ip | grep open-resolver-detected)
if [ -z "$OUT" ]; then
echo "$ip is not an open resolver"
else
echo "$ip IS an open resolver!"
fi
done
Quick wget command (run as root):
wget http://openresolver.com/openvz-scan.sh
chmod 0700 openvz-scan.sh
./openvz-scan.sh
Sample output:
Manually test an IP address:
This script scans all OpenVZ containers on a node for open DNS resolvers:
#!/bin/bash
echo "Simple script to scan all OpenVZ containers for open DNS resolvers"
echo "For web-based testing use http://openresolver.com"
for ip in `vzlist -H | awk '{print $4}'`;
do
OUT=$(dig +short +tries=1 +time=2 test.openresolver.com TXT @$ip | grep open-resolver-detected)
if [ -z "$OUT" ]; then
echo "$ip is not an open resolver"
else
echo "$ip IS an open resolver!"
fi
done
Quick wget command (run as root):
wget http://openresolver.com/openvz-scan.sh
chmod 0700 openvz-scan.sh
./openvz-scan.sh
Sample output:
Manually test an IP address:
Code:
dig +short test.openresolver.com TXT @1.2.3.4
#Replace 1.2.3.4 with the IP address or domain name of the DNS server you are testing.
