Dopln\u011bn\u00ed na\u0161eho p\u016fvodn\u00edho tvrzen\u00ed „<\/strong>Ano, je p\u0159ekvapen\u00ed, \u017ee DNS servery CZ.NICu nevaliduj\u00ed DNSSEC.“ a vysv\u011btlen\u00ed ze strany CZ.NIC <\/strong>(21. 4. 2017)<\/strong>:
„Na\u0161e DNS samoz\u0159ejm\u011b validuj\u00ed, ve va\u0161em p\u0159\u00edpad\u011b to \u010d\u00e1ste\u010dn\u011b fungovalo proto, \u017ee unbound v defaultn\u00edm nastaven\u00ed (n\u00e1\u0161 p\u0159\u00edpad) dr\u017e\u00ed expirovan\u00e9 podpisy 10% doby platnosti podpisu (expiration-inception). S t\u00edm, \u017ee minim\u00e1ln\u00ed \u010das je jedna hodina, maxim\u00e1ln\u00ed pak 24 hodin.<\/em><\/p>\n\n\n\n
Tak\u017ee z toho m\u016f\u017eeme asi konstatovat, \u017ee opravdu po n\u011bjakou dobu na\u0161e ODVR nevracelo chybu, p\u0159esto\u017ee byl expirovan\u00fd DNSSEC.“<\/em> .CZ dom\u00e9ny, kter\u00e9 u n\u00e1s maj\u00ed DNS s nastaven\u00fdm DNSSEC se pro n\u00e1v\u0161t\u011bvn\u00edka, jeho\u017e resolver ov\u011b\u0159uje platnost DNSSEC zd\u00e1li jako nedostupn\u00e9. Toto postihlo odhadem 3 – 5 % n\u00e1v\u0161t\u011bvn\u00edk\u016f. Jednalo se o n\u00e1v\u0161t\u011bvn\u00edky z \u010ceska, kte\u0159\u00ed pou\u017e\u00edvaj\u00ed DNS Google, \u010d\u00e1st n\u00e1v\u0161t\u011bvn\u00edk\u016f s\u00edt\u011b O2 a Vodafone a n\u011bkter\u00fdch dal\u0161\u00ed s\u00edt\u00ed.<\/p>\n\n\n\n K tomuto \u010d\u00edslu jsme do\u0161li porovn\u00e1n\u00edm p\u0159\u00edstup\u016f z webhosting\u016f z log\u016f na\u0161\u00ed DDoS ochrany, kter\u00e1 s\u00ed\u0165 detailn\u011b monitoruje, d\u00e1le porovn\u00e1n\u00edm p\u0159enos\u016f dat od na\u0161ich dodavatel\u016f konektivity.<\/p>\n\n\n\n Nejednalo se tedy o nedostupnost kompletn\u011b v\u0161eho nebo naopak o to, \u017ee by neproch\u00e1zela \u010d\u00e1st po\u017eadavk\u016f, ale jednalo se o to, \u017ee z n\u011bkter\u00fdch s\u00edt\u00ed byly skute\u010dn\u011b dom\u00e9ny nedostupn\u00e9 nebo m\u00e9n\u011b dostupn\u00e9 a to v z\u00e1vislosti na tom jak\u00e9 DNS servery konkr\u00e9tn\u00ed n\u00e1v\u0161t\u011bvn\u00edk pou\u017eil. <\/p>\n\n\n\n Na n\u00e1sleduj\u00edc\u00edm grafu vid\u00edte celkov\u00fd provoz od 16:00 3.4.2017 do 16:00 4.4.2017. V horn\u00ed \u010d\u00e1sti je p\u0159\u00edchoz\u00ed provoz z internetu k n\u00e1m a v spodn\u00ed \u010d\u00e1sti odchoz\u00ed provoz od n\u00e1s do internetu (k n\u00e1v\u0161t\u011bvn\u00edk\u016fm). <\/p>\n\n\n\n Pro porovn\u00e1n\u00ed celkov\u00fd provoz od 16:00 3.4.2017 do 16:00 6.4.2017. <\/p>\n\n\n\n Jak vid\u00edte na grafech \u017e\u00e1dn\u00e9 velk\u00e9 propady n\u00e1v\u0161t\u011bvnosti nejsou po dobu incidentu vid\u011bt. DDoS v\u011bt\u0161ina neov\u011b\u0159uje. <\/p>\n\n\n\n Samoz\u0159ejm\u011b celkov\u00fd provoz zahrnuje webhostingy, VPS, dedikovan\u00e9 servery a WEDOS disk. Proto jsme vybrali je\u0161t\u011b graf \u010dist\u011b 88 tis\u00edc webhosting\u016f NoLimit p\u0159es IPv4 a IPv6 podle druhu komunikace. Graf zahrnuje obdob\u00ed od 16:00 3.4.2017 do 16:00 6.4.2017. Na\u0161e DDoS ochrana dok\u00e1\u017ee v\u0161echno velmi detailn\u011b kontrolovat a vyhodnocovat v re\u00e1ln\u00e9m \u010dase.<\/p>\n\n\n\n Psali jsme, \u017ee nedostupnost se dotkla jen n\u011bkter\u00fdch s\u00edt\u00ed. Pro porovn\u00e1n\u00ed v\u00e1m p\u0159in\u00e1\u0161\u00edme grafy p\u0159enos\u016f z t\u011bch nejv\u011bt\u0161\u00edch. Jedn\u00e1 se o dobu od 16:00 3.4.2017 do 16:00 6.6.2017. <\/p>\n\n\n\n Vylep\u0161ili jsme monitoring podobn\u00fdch situac\u00ed a bude prov\u00e1d\u011bna nejen automatick\u00e1 kontrola, ale i pravideln\u00e1 kontrola prost\u0159ednictv\u00edm \u010dlov\u011bka.<\/p>\n\n\n\n Rychlej\u0161\u00ed gener\u00e1tor z\u00f3nov\u00fdch soubor\u016f dovol\u00ed prov\u00e1d\u011bt zm\u011bny v DNS rychleji.<\/p>\n\n\n\n D\u00e1le m\u00e1me v pl\u00e1nu upravit na\u0161e webov\u00e9 rozhran\u00ed pro emaily tak, aby zmizela n\u011bkter\u00e1 omezen\u00ed. P\u0159eci jen pokud se u\u017eivatel u\u017e jednou do webov\u00e9ho rozhran\u00ed p\u0159ihl\u00e1s\u00ed, tak nen\u00ed nutn\u00e9 ov\u011b\u0159ovat zdali odes\u00edl\u00e1 email z dom\u00e9ny ke kter\u00e9 je p\u0159ihl\u00e1\u0161en. C\u00edlem je dos\u00e1hnout stavu, kdy p\u0159es na\u0161e webov\u00e9 rozhran\u00ed p\u016fjde odes\u00edlat email za v\u0161ech okolnost\u00ed.<\/p>\n\n\n\n V pr\u016fb\u011bhu ve\u010dera byla na\u0161e z\u00e1kaznick\u00e1 podpora p\u0159et\u00ed\u017een\u00e1, proto\u017ee p\u0159ijala n\u011bkolik tis\u00edc mail\u016f a chat\u016f s po\u017eadavky, kter\u00e9 souvisej\u00ed s v\u00fd\u0161e uveden\u00fdm probl\u00e9mem.<\/p>\n\n\n\n Pokud oper\u00e1tor nem\u016f\u017ee p\u0159ijmout chat v d\u016fsledku toho, \u017ee jich m\u00e1 otev\u0159en\u00fdch v\u00edce ne\u017e zvl\u00e1dne, tak po ur\u010dit\u00e9 dob\u011b „spadne“ komunikace do po\u017eadavk\u016f (podobn\u011b jako zpr\u00e1vy z kontaktn\u00edho formul\u00e1\u0159e). Jakmile m\u00e1 oper\u00e1tor „voln\u00e9 ruce“, tak proch\u00e1z\u00ed po\u017eadavky a postupn\u011b na n\u011b odpov\u00edd\u00e1 emailem. <\/p>\n\n\n\n Kolegov\u00e9 po\u017eadavky postupn\u011b vy\u0159izovali a b\u011bhem noci bylo vy\u0159\u00edzeno v\u0161e. R\u00e1no u\u017e jsme odpov\u00eddali na v\u0161echny dotazy pr\u016fb\u011b\u017en\u011b.<\/p>\n\n\n\n Omlouv\u00e1me se za komplikaci. Mus\u00edme uznat, \u017ee to byla nep\u0159\u00edjemn\u00e1 chyba a na po\u010d\u00e1tku jsme m\u011bli strach o to, \u017ee dopad bude mnohem nep\u0159\u00edjemn\u011bj\u0161\u00ed, ne\u017e nakonec byl. Z t\u00e9to nep\u0159\u00edjemn\u00e9 zku\u0161enosti jsme se pou\u010dili a ud\u011bl\u00e1me n\u011bkolik \u00faprav, aby se to p\u0159\u00ed\u0161t\u011b neopakovalo.<\/p>\n","protected":false},"excerpt":{"rendered":" Jako v\u017edy jsme otev\u0159eni a nic netaj\u00edme.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,32],"tags":[],"class_list":["post-55249","post","type-post","status-publish","format-standard","hentry","category-spolecnost","category-novinky"],"_links":{"self":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/55249","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/comments?post=55249"}],"version-history":[{"count":1,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/55249\/revisions"}],"predecessor-version":[{"id":55298,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/55249\/revisions\/55298"}],"wp:attachment":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/media?parent=55249"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/categories?post=55249"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/tags?post=55249"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Za nep\u0159esnou formulaci se omlouv\u00e1me. Ur\u010dit\u011b to nebylo nic proti CZ.NIC, ale popisujeme celou situaci.<\/strong><\/p>\n\n\n\nWeby<\/h3>\n\n\n\n
Porovn\u00e1n\u00ed provozu<\/h3>\n\n\n\n
![\"\"](\"https:\/\/blog.wedos.cz\/wp-content\/uploads\/2021\/01\/r4-bits-0403-0404.png\")
<\/a><\/figure>\n\n\n\n<\/a><\/figure>\n\n\n\n<\/a><\/figure>\n\n\n\nJednotliv\u00e9 s\u00edt\u011b<\/h3>\n\n\n\n
Telefonica Czech Republic, a.s. (O2)<\/h3>\n\n\n\n
<\/a><\/figure>\n\n\n\nUPC Liberty Global Operations B.V.<\/h3>\n\n\n\n
<\/a><\/figure>\n\n\n\nT-Mobile Czech Republic a.s.<\/h3>\n\n\n\n
<\/a><\/figure>\n\n\n\nVodafone Czech Republic a.s.<\/h3>\n\n\n\n
<\/a><\/figure>\n\n\n\nCo jsme ud\u011blali proto, aby se to u\u017e nikdy nestalo a pl\u00e1novan\u00e1 vylep\u0161en\u00ed<\/h2>\n\n\n\n
Z\u00e1kaznick\u00e1 podpora<\/h2>\n\n\n\n
Z\u00e1v\u011br<\/h2>\n\n\n\n