CloudatCost OpenDNS Issue

thanksajdotcom

So I'm getting the following email:

===============================================
A.J. Stringham,

This message contains details on a OPEN DNS resolver found on the network..

Please login to the console of this panel and fix this problem.
https://panel.cloudatcost.com

Server Information:
IP: 104.167.117.250

Instruction can be found to resolve this issue here.
https://members.cloudatcost.com/index.php?fuse=knowledgebase&view=KB_viewArticle&articleId=13

NOTE: Avoiding action on this will result in your server port being shut down.

Thankyou for your business.

CloudAtCost 2014

===============================================

I WAS using OpenDNS before but now I am not. Not sure what's going on but the alert keeps coming up and threatening to shut down my server. Not cool. How do I resolve this?

scottalanmiller

AJ, you are confusing OpenDNS the vendor and an open DNS server. You are running a DNS server on your system and exposing it to the world. This violates your terms of use and you need to shut it down. This has nothing whatsoever to do with OpenDNS.

You have port 53 exposed and talking to the outside world.

scottalanmiller

And you definitely are running public DNS servers. I can use you as my DNS source.

nslookup yahoo.com 104.167.117.250
Server:         104.167.117.250
Address:        104.167.117.250#53

Non-authoritative answer:
Name:   yahoo.com
Address: 98.138.253.109
Name:   yahoo.com
Address: 98.139.183.24
Name:   yahoo.com
Address: 206.190.36.45

scottalanmiller

How did this happen?

OpenDNS and Open DNS aren't the same. Do a port scan on port 53. Lock down Port 53 via the firewall.

@scottalanmiller said:

And you definitely are running public DNS servers. I can use you as my DNS source.

nslookup yahoo.com 104.167.117.250
Server:         104.167.117.250
Address:        104.167.117.250#53

Non-authoritative answer:
Name:   yahoo.com
Address: 98.138.253.109
Name:   yahoo.com
Address: 98.139.183.24
Name:   yahoo.com
Address: 206.190.36.45

Oh wow. Did you install Bind?

Also, why is your firewall off?

scottalanmiller

He must have! Or MaraDNS or whatever that competitor is called.

thanksajdotcom

It's a DC. It's my failover. What do I need to change?

scottalanmiller

@thanksajdotcom said:

It's a DC. It's my failover. What do I need to change?

OH! He publicly exposed a Domain Controller!!!

You have it wide open, like it is sitting on a LAN. You have DNS, DHCP, AD, etc. open to the world because your "LAN" is the Internet!!

@thanksajdotcom said:

It's a DC. It's my failover. What do I need to change?

Change the Zone's the ports are allowed on. Only allow it on the VPN Zone. Aka Not Public.

thanksajdotcom

Just lock down DNS to internal only or what?

I would never trust that DC again. Time to rebuild.

thanksajdotcom

@Aaron-Studer said:

I would never trust that DC again. Time to rebuild.

It's secured with Webroot. Also, there's been no indication of an attack. I'm not decomming it without a good reason.

thanksajdotcom

@thecreativeone91 said:

@thanksajdotcom said:

It's a DC. It's my failover. What do I need to change?

Change the Zone's the ports are allowed on. Only allow it on the VPN Zone. Aka Not Public.

Ok, so in Windows Firewall?

scottalanmiller

@thanksajdotcom said:

@Aaron-Studer said:

I would never trust that DC again. Time to rebuild.

It's secured with Webroot. Also, there's been no indication of an attack. I'm not decomming it without a good reason.

It's not like he'll have it for long anyway. He doesn't have a datacenter license for every CPU in the cloud so he can't run anything but a demo license that expires in 90 days there.

At least you don't have any open SMB shares.

@thecreativeone91 How do you know this? I bet he did it is a domain controller after all.

scottalanmiller

@Aaron-Studer said:

@thecreativeone91 How do you know this?

You can just attempt to connect

I am using AJ as my DNS server now! THANKSAJ! =P