Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having huge problem. I removed the domains but somebody is still running, now even more, scripts from many different ip addresses in order get in and use my server for spamming.

In /var/log/syslog i constantly see new lines coming up:

Apr  2 01:55:35 158115 named[10131]: client query (cache) '' denied
Apr  2 01:55:35 158115 named[10131]: client query (cache) '' denied
Apr  2 01:55:35 158115 named[10131]: client query (cache) '' denied
Apr  2 01:55:35 158115 named[10131]: client query (cache) '' denied

And i notices at least 20-50 different ip addresses.

Is there way to auto block those attempts?

For ssh i use fail2ban and it's ok but i don't know how to react to this....

share|improve this question

closed as not a real question by Michael Hampton, Wesley, Jenny D, Khaled, Jacob Apr 2 '13 at 13:45

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

This has absolutely nothing to do with your mail server, and the requests were already blocked. – Michael Hampton Apr 2 '13 at 0:01
Today, i had this in postqueue -p this: -- 65037 Kbytes in 9180 Requests Emails from same domains and i discovered backdoor in joomla installation that "idiot" site owner installed. The mail attack was towards sending emails. – mariotanenbaum Apr 2 '13 at 0:05
If you erased all the relevant logs, then nobody can help you. – Michael Hampton Apr 2 '13 at 0:18
You chose to ignore them when you deleted the evidence – Joel E Salas Apr 2 '13 at 0:29
Everyone makes mistakes. We have only pointed out the consequences of your particular mistake. – Michael Hampton Apr 2 '13 at 0:35
up vote 2 down vote accepted

Per the comments, you don't have this logged anymore. Logs are useful! Without logs you can't do any kind of diagnostic, nor can you take preventative measures. Some services (like the fail2ban you mentioned) rely entirely on logs to do their job. You are advised to not delete logs again until you're confident you won't need them.

Your best option now is to wait for it to happen again. Set up something like OSSEC to watch your logs and email you when too many failures have been logged.

share|improve this answer
Well, that is one of possible answers too. Thnx. – mariotanenbaum Apr 2 '13 at 0:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.