[/var/log/messages] wat gebeurt hier?

[DPLuS]

In /var/log/messages staat het eea waarvan ik niet weet wat er precies gebeurt.
Een client (62.56.228.214 wat resolved naar: cust214-228.netcabo.co.mz) probeert mijn zone-file te updaten, maar heeft daar blijkbaar geen permissie voor.
Is dit misschien een hack-poging of een zoekpoging naar een exploit??

logfile:

code:

May  8 01:37:43 anaconda named[454]: client 62.56.228.214#2246: updating zone 'xxx.com/IN': update failed: 'RRset exists (value d
ependent)' prerequisite not satisfied (NXRRSET)
May  8 01:37:46 anaconda named[454]: client 62.56.228.214#2249: update 'xxx.com/IN' denied
May  8 02:37:51 anaconda named[454]: client 62.56.228.214#2259: updating zone 'xxx.com/IN': update failed: 'RRset exists (value d
ependent)' prerequisite not satisfied (NXRRSET)
May  8 02:37:53 anaconda named[454]: client 62.56.228.214#2262: update 'xxx.com/IN' denied
May  8 02:37:58 anaconda named[454]: client 62.56.228.214#2262: update 'xxx.com/IN' denied

[ Voor 10% gewijzigd door DPLuS op 08-05-2003 14:27 ]

[Verwijderd]

Dit is of een poging om de Cached RR sets te poisonen (oid, kijk op de isc website voor details), of een misconfigured windows box die zijn ip bij jou probeerd te reggen. Ik neem aan dat je een reden hebt om named op je externe interface te draaien?

[ Voor 12% gewijzigd door Verwijderd op 08-05-2003 14:37 ]

[Wilke]

Gezien de posthistory van deze user vermoed ik van niet, volgens mij draait hij het gewoon op een thuissysteem, nietwaar?

Met andere woorden: stel named zo in dat 'ie alleen op de interne interface luistert, en niet naar buiten toe! Dan weet je sowieso zeker dat niemand hem kan misbruiken.

[DPLuS]

Bind 9 draait op mijn eigen co-located server in A'dam ( van redhat 8 ).
Hier draai ik dus mijn eigen DNS-server voor een tiental domeinen die op die server gehost worden.
Dus als kwaadwillende personen iets van plan zijn, moet ik daar op tijd een stokje voor steken...

[DPLuS]

*UPDATE*

Die gast in Mozambique blijft maar van die update-requests sturen aan mijn DNS server.
Kan dit verder geen kwaad zo lang er staat: access denied ?
Moet ik verder nog actie ondernemen?

Uit /var/log/messages:


[root@anaconda log]# cat messages | grep named
May 7 22:37:57 anaconda named[454]: client 62.56.228.214#1039: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 7 22:37:59 anaconda named[454]: client 62.56.228.214#1042: update 'mijn_domein.com/IN' denied
May 7 23:38:03 anaconda named[454]: client 62.56.228.214#1592: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 7 23:38:05 anaconda named[454]: client 62.56.228.214#1596: update 'mijn_domein.com/IN' denied
May 8 00:07:42 anaconda named[454]: client 62.56.228.214#2144: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 00:07:44 anaconda named[454]: client 62.56.228.214#2147: update 'mijn_domein.com/IN' denied
May 8 01:07:47 anaconda named[454]: client 62.56.228.214#2236: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 01:07:49 anaconda named[454]: client 62.56.228.214#2239: update 'mijn_domein.com/IN' denied
May 8 01:37:43 anaconda named[454]: client 62.56.228.214#2246: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 01:37:46 anaconda named[454]: client 62.56.228.214#2249: update 'mijn_domein.com/IN' denied
May 8 02:37:51 anaconda named[454]: client 62.56.228.214#2259: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 02:37:53 anaconda named[454]: client 62.56.228.214#2262: update 'mijn_domein.com/IN' denied
May 8 02:37:58 anaconda named[454]: client 62.56.228.214#2262: update 'mijn_domein.com/IN' denied
May 8 07:24:24 anaconda named[454]: client 62.56.228.214#2341: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 07:24:26 anaconda named[454]: client 62.56.228.214#2344: update 'mijn_domein.com/IN' denied
May 8 07:37:45 anaconda named[454]: client 62.56.228.214#2367: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 07:37:47 anaconda named[454]: client 62.56.228.214#2370: update 'mijn_domein.com/IN' denied
May 8 08:37:51 anaconda named[454]: client 62.56.228.214#2406: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 08:37:53 anaconda named[454]: client 62.56.228.214#2409: update 'mijn_domein.com/IN' denied
May 8 09:07:48 anaconda named[454]: client 62.56.228.214#2417: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 09:07:51 anaconda named[454]: client 62.56.228.214#2420: update 'mijn_domein.com/IN' denied
May 8 10:07:56 anaconda named[454]: client 62.56.228.214#2554: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 10:07:59 anaconda named[454]: client 62.56.228.214#2557: update 'mijn_domein.com/IN' denied
May 8 10:37:44 anaconda named[454]: client 62.56.228.214#2567: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 10:37:51 anaconda named[454]: client 62.56.228.214#2570: update 'mijn_domein.com/IN' denied
May 8 11:37:55 anaconda named[454]: client 62.56.228.214#2613: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 11:37:57 anaconda named[454]: client 62.56.228.214#2616: update 'mijn_domein.com/IN' denied
May 8 12:07:46 anaconda named[454]: client 62.56.228.214#2624: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 13:08:06 anaconda named[454]: client 62.56.228.214#2797: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 13:08:13 anaconda named[454]: client 62.56.228.214#2800: update 'mijn_domein.com/IN' denied
May 8 13:37:44 anaconda named[454]: client 62.56.228.214#2839: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 13:37:46 anaconda named[454]: client 62.56.228.214#2842: update 'mijn_domein.com/IN' denied
May 8 14:37:50 anaconda named[454]: client 62.56.228.214#2881: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 14:37:55 anaconda named[454]: client 62.56.228.214#2881: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 15:07:31 anaconda named[454]: client 62.56.228.214#3072: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 15:07:38 anaconda named[454]: client 62.56.228.214#3075: update 'mijn_domein.com/IN' denied
May 8 16:47:02 anaconda named[454]: client 193.220.24.214#1237: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 16:47:04 anaconda named[454]: client 193.220.24.214#1240: update 'mijn_domein.com/IN' denied
May 8 16:47:13 anaconda named[454]: client 193.220.24.214#1247: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 16:47:14 anaconda named[454]: client 193.220.24.214#1252: update 'mijn_domein.com/IN' denied
May 8 23:14:32 anaconda named[454]: client 62.56.227.49#1251: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 23:14:35 anaconda named[454]: client 62.56.227.49#1254: update 'mijn_domein.com/IN' denied
May 8 23:14:37 anaconda named[454]: client 62.56.227.49#1262: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 8 23:14:39 anaconda named[454]: client 62.56.227.49#1265: update 'mijn_domein.com/IN' denied
May 9 00:14:42 anaconda named[454]: client 62.56.227.49#1534: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 9 00:14:44 anaconda named[454]: client 62.56.227.49#1537: update 'mijn_domein.com/IN' denied
May 9 00:44:31 anaconda named[454]: client 62.56.227.49#1544: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 9 00:44:33 anaconda named[454]: client 62.56.227.49#1547: update 'mijn_domein.com/IN' denied
May 9 01:44:37 anaconda named[454]: client 62.56.227.49#1559: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 9 01:44:39 anaconda named[454]: client 62.56.227.49#1562: update 'mijn_domein.com/IN' denied
May 9 02:14:31 anaconda named[454]: client 62.56.227.49#1569: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 9 02:14:33 anaconda named[454]: client 62.56.227.49#1572: update 'mijn_domein.com/IN' denied
May 9 03:14:36 anaconda named[454]: client 62.56.227.49#1582: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 9 03:14:39 anaconda named[454]: client 62.56.227.49#1585: update 'mijn_domein.com/IN' denied
May 9 03:44:32 anaconda named[454]: client 62.56.227.49#1592: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 9 03:44:34 anaconda named[454]: client 62.56.227.49#1595: update 'mijn_domein.com/IN' denied
May 9 04:44:37 anaconda named[454]: client 62.56.227.49#1609: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 9 04:44:39 anaconda named[454]: client 62.56.227.49#1612: update 'mijn_domein.com/IN' denied
May 9 05:14:33 anaconda named[454]: client 62.56.227.49#1619: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 9 05:14:36 anaconda named[454]: client 62.56.227.49#1622: update 'mijn_domein.com/IN' denied
May 9 06:14:40 anaconda named[454]: client 62.56.227.49#1633: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 9 06:14:42 anaconda named[454]: client 62.56.227.49#1636: update 'mijn_domein.com/IN' denied
May 9 06:44:31 anaconda named[454]: client 62.56.227.49#1643: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 9 06:44:33 anaconda named[454]: client 62.56.227.49#1646: update 'mijn_domein.com/IN' denied
May 9 07:44:37 anaconda named[454]: client 62.56.227.49#1655: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 9 07:44:39 anaconda named[454]: client 62.56.227.49#1658: update 'mijn_domein.com/IN' denied
May 9 08:14:30 anaconda named[454]: client 62.56.227.49#1665: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 9 08:14:32 anaconda named[454]: client 62.56.227.49#1668: update 'mijn_domein.com/IN' denied
May 9 12:47:32 anaconda named[454]: client 62.56.227.49#1045: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 9 12:47:33 anaconda named[454]: client 62.56.227.49#1048: update 'mijn_domein.com/IN' denied
May 9 12:47:37 anaconda named[454]: client 62.56.227.49#1060: updating zone 'mijn_domein.com/IN': update failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
May 9 12:47:39 anaconda named[454]: client 62.56.227.49#1063: update 'mijn_domein.com/IN' denied

[_JGC_]

Gooi die gast gewoon in je firewall op poort 53, weet je zeker dat je er nooit weer last van krijgt.

[Verwijderd]

iptables -A INPUT -s <hetipuitmozambique> -d <jouwip> --dport 53 -j DROP

[ Voor 13% gewijzigd door Verwijderd op 09-05-2003 13:53 ]

[Mior]

Of: route add -host 62.56.227.49 gw 127.0.0.2

[Wilke]

Zal wel een of andere achterlijke gladiool zijn die een willekeurig IP heeft ingevuld voor z'n netwerkinstellingen/DNS, en toevallig net die van jou te pakken heeft

Anyway, gewoon bannen die gast idd, en ik zou voor de manier gaan die r3b00t voorstelt.