Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is this an attack? I get a lot of :

view external: query (cache) denied in the /var/log/messages

share|improve this question

No that's no hack ;) Obviously Your DNS server isn't set up well. Try adding nameserver to DNS server's /etc/resolv.conf and add your subnet ( to /etc/bind/named.conf

acl internals {;; };

share|improve this answer

It is probably not an attack. The only one thing that I'd suggest to better bind9 configuration is to set up logging so that such kind of security lines are written in their own file. For example, in the "logging" stanza:

channel security_log { 
            file "/var/log/named-denied.log" versions 3;
            print-time yes;
            print-severity yes;
            print-category yes;
            severity info;


category security { security_log; };

If bind is configured well, that file will be filled with queries that shouldn't have been directed to your server in the first place. It is possible to extract recurring patterns, for example expired delegations --even after several years.

share|improve this answer

It's not a hack however you need to set up your server's DNS better. If you use cpanel for your control panel WHM should automatically pick up the information. If not you can fix it later on when you set up your name servers, set an ip to them, etc.

share|improve this answer
Please try to write understandable English. – vonbrand Mar 10 '13 at 2:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.