0

I have around 200k same entries in my /var/log/messages received from named, like:

Oct 29 15:48:34 server named[878]: client 75.100.*.*#56448: view external: query (cache) 'example.com.co/A/IN' denied

Where example.com.co is an external domain not related to my site and being blocked for some reasons. External view is configured as below:

view    "external" {
    recursion no;

    zone "." IN {
        type hint;
        file "/var/named/named.ca";
    };

zone "example2.com" {
        type master;
        file "/var/named/example2.db";
};
};

Where example2.com is my own domain. Could you please explain what actually does the log entry mean and what should I do to prevent it from being logged?

Thanks.

Configuration: CentOS 6, BIND 9.7

1 Answer 1

1

It seems you have users querying your server for names that aren't yours. If the 200k log events are all from the same client IP address, I'd block that IP in my firewall for 24-48 hours to see if they stop and report them to their ISP. If they're from many different addresses (especially from different ISPs and different parts of the world), I'd spend some time to figure out why they're querying your server.

dig example.com.co. NS

Does the above command mistakenly list your name server as an authoritative one for their domain? If so, contact them using their whois contact information.

1
  • All IPs are different and ISP's as well. Interesting, but many domains are not existent and many of them are from porno resources. I've blocked most popular IP's but that didn't help much. Possible a DOS attack on my server?
    – Andrew
    Oct 30, 2011 at 0:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .