inadvertedly, a bind9 server I ran was an open resolver. Whoops.
Now it's been months and the recursive queries for
isc.org are still incoming. I would not mind if my
/var/log/syslog did not look like this:
Jul 6 01:10:23 servername last message repeated 6 times Jul 6 01:10:23 servername named: client YYY.YY.YYY.YYY#25345: query (cache) 'isc.org/ANY/IN' denied Jul 6 01:10:23 servername named: client ZZZ.ZZ.ZZZ.ZZ#25345: query (cache) 'isc.org/ANY/IN' denied Jul 6 01:10:23 servername last message repeated 7 times Jul 6 01:10:23 servername named: client AAA.AAA.A.AAA#25345: query (cache) 'isc.org/ANY/IN' denied Jul 6 01:10:23 servername named: client BBB.BB.BB.BBB#25345: query (cache) 'isc.org/ANY/IN' denied Jul 6 01:10:23 servername last message repeated 6 times
(One might find it funny that the above messages all appear within one second... I no longer don't.)
This really, REALLY makes it hard to catch any real errors that another service on the system may report.
I'd like to make bind9 no longer log these messages. And I'm crossing my fingers that it is possible to make only these messages disappear from the logs.
In what way can I disable messages that recursion is disallowed from appearing in the syslog (or other logs)?
servername:/etc/bind9# named -V BIND 9.8.4-rpz2+rl005.12-P1 built with '--prefix=/usr' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/var' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-geoip=/usr' '--enable-ipv6' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -O2' using OpenSSL version: OpenSSL 1.0.1c 10 May 2012 using libxml2 version: 2.8.0 servernane:/etc/bind9# uname -a Linux servername 3.2.0-4-686-pae #1 SMP Debian 3.2.35-2 i686 GNU/Linux
I'm interested in more detailed example on how to silence just the 'recursion denied'-type messages.
uname -a. If you need more information than that, I'll check in greater detail.
ANY?is always your first hint, and
isc.orgis the classic query). You've made it into a list of known open recursors that bots are using. While this isn't the answer that you're looking for, you might want to change the IP address of these DNS servers and give the IPs to something where you can safely drop port 53. You'd probably want to change the glue record naming scheme as well.
ns1.foobar.com, changing the IP doesn't help if
ns1.foobar.comstill gets someone to your nameserver. Changing the scheme (example:
ns1.east.foobar.com) breaks the robots but doesn't break your actual clients, since the servers that are behaving correctly are tracing their way to your domains from the root nameservers.