Unexpected RCODE(SERVFAIL) causing bind to crash?

Question

Every two days or so, my server stops responding entirely to its services. I can ping it, but I cannot use SSH so I have to go into my host's control panel and reset it.

When it comes back up, the last log entry before the crash in /var/log/messages are variations on the following:

named[3493]: unexpected RCODE (SERVFAIL) resolving '3.39.148.159.in-addr.arpa/PTR/IN': 193.0.0.193#53

Could this be a part of a DoS attack? I have not configured bind on this server and didn't think I'd need to (however naïve that may be).

Answer 1

Question first off: does it actually need the bind accessible to the outside world? If not, just block ingoing traffic on the DNS ports, and you're all set.

But yes, indirectly this is part of an 'attack', as your mail server is probably trying to bounce back "user not found" mails to bogus servers.

And do you have spamassassin running on your machine? If you're hit by a spamwave and the perl spamassassin is trying to handle all the mail, it might take down your system on unlucky configurations.

Answer 2

That syslog entry is most likely your machine trying to lookup the IP of a host that just connected to it. 193.0.0.193 is one of RIPE's DNS servers which are authoritative for part of the in-addr.arpa tree used to map from IP to hostname.

It is exceedingly unlikely that these DNS queries are causing your machine to crash. It's far more likely to be the resource drain from whatever inbound traffic is indirectly causing the DNS lookups.

It would be most useful for you to look at what inbound services your server is offering to the outside world, and to decide whether you need to perform DNS lookups in real-time for each of those inbound connections.

For example, if this is a web-server, don't store hostnames in the logfiles, just store the remote IP addresses. Then add the hostnames later (should you ever need to) offline.

Answer 3

What version of bind? Also, is it possible to run tcpdump of the server to catch the query as it comes in? I'd be surprised if bind was killing the whole machine, so is there anything interesting before the above named entry in the logs?