Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is this an attack? I get a lot of :

view external: query (cache) denied in the /var/log/messages

share|improve this question
add comment

3 Answers

No that's no hack ;) Obviously Your DNS server isn't set up well. Try adding nameserver 127.0.0.1 to DNS server's /etc/resolv.conf and add your subnet (192.168.0.0/24) to /etc/bind/named.conf

acl internals { 127.0.0.0/8; 192.168.0.0/24; };

share|improve this answer
add comment

It is probably not an attack. The only one thing that I'd suggest to better bind9 configuration is to set up logging so that such kind of security lines are written in their own file. For example, in the "logging" stanza:

channel security_log { 
            file "/var/log/named-denied.log" versions 3;
            print-time yes;
            print-severity yes;
            print-category yes;
            severity info;
};

and

category security { security_log; };

If bind is configured well, that file will be filled with queries that shouldn't have been directed to your server in the first place. It is possible to extract recurring patterns, for example expired delegations --even after several years.

share|improve this answer
add comment

It's not a hack however you need to set up your server's DNS better. If you use cpanel for your control panel WHM should automatically pick up the information. If not you can fix it later on when you set up your name servers, set an ip to them, etc.

share|improve this answer
    
Please try to write understandable English. –  vonbrand Mar 10 '13 at 2:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.