Linux dns is hijacked, and linuxdns is hijacked

Linux dns is hijacked, and linuxdns is hijacked

Environment: ubuntu16.04

We have encountered dns hijacking today. Here we record it:

1. First, how to determine whether a hijacking occurs:

Query a domain name that does not exist.

Nslookup notexit. comrrrr

If an IP address is returned, dns is hijacked. Assume that the IP address is 123.34.5.6.

Use the 8.8.8.8 Domain Name Server to resolve this incorrect Domain Name:

Nslookup notexit. comrrrr 8.8.8.8

The output content is as follows:

Jello @ jello :~ $ Nslookup notexit. comrrrr 8.8.8.8
Server: 8.8.8.8
Address: 8.8.8.8 #53

** Server can't find notexit. comrrrr: NXDOMAIN

 

The prompt indicates that this domain name does not exist.

2. How can this problem be solved?

Because ubuntu16.04 uses dnsmasq to resolve the domain name, modify the configuration file of dnsmasq:

Because linux has a restriction on processing dns requests, in/etc/resolv. only three dns addresses can be configured in conf. in the conf file, only localhost is retained as the Domain Name Server, create a configuration file to store the address of the external Domain Name Server, and add the configuration file to the configuration item resolv-file of dnsmasq. For example:

2.1 create the configuration file/etc/resolv. my. conf and enter the following content:

Nameserver 8.8.8.8

Nameserver 8.8.4.4

2.2 Add the following content to/etc/dnsmasq. conf:

Resolv-file =/etc/resolv. my. conf

2.3 restart dnsmasq

Systemctl restart dnsmasq

 

Note: If the dnsmasq restart times out, enable/var/run/dnsmasq/resolv. conf directly.

There is a domain name server address obtained by parsing a domain name that does not exist. You can delete a line that contains the Domain Name Server address. Assume that the content of this file is:

Nameserver 123.34.5.6

Nameserver 231.43.5.45

Delete the nameserver 123.34.5.6 directly.

 

The most effective solution is as follows:

3. You can also directly replace the two ip addresses with other Domain Name Server addresses, and then restart dnsmasq. After the author modifies the configuration file/var/run/dnsmasq/resolv. conf as follows:

Nameserver 8.8.8.8

Nameserver 8.8.4.4

Restart dnsmasq:

Systemctl restart dnsmasq