Over the past couple of weeks, we've seen an uptick in reports of DDOS attempts using open SNMP servers. A handful of those have been BlueOnyx servers with SNMP enabled.
In case you're unfamiliar, the current rash of SNMP-based attacks isn't exactly new, and it's nearly identical to what we saw not very long ago with the DNS amplification exploits. I'm not quite sure why we seem to be catching more of it now. My suggestion is this: unless you are actively using SNMP to communicate with your BlueOnyx server, leave SNMP service disabled from the GUI. There's no need to run it if you're not using it, and it's only another door for bad guys. If you do use SNMP, I encourage you to use a nice, cryptic string as your public string. For instance "PUBLIC" or "SNMP" would be examples of what not to use. I would encourage you to treat your SNMP string as a password and make it nice and strong. If you want some further reading on SNMP attacks, this is pretty easy to read: https://bechtsoudis.com/hacking/snmp-reflected-denial-of-service/ -- Chris Gebhardt VIRTBIZ Internet Services Access, Web Hosting, Colocation, Dedicated www.virtbiz.com | toll-free (866) 4 VIRTBIZ _______________________________________________ Blueonyx mailing list [email protected] http://mail.blueonyx.it/mailman/listinfo/blueonyx
