Linux - Security This forum is for all security related questions.
Notices
Welcome to
LinuxQuestions.org , a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free.
Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please
contact us . If you need to reset your password,
click here .
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
#1
LQ Newbie
Registered: Oct 2006
Distribution: Ubuntu 9.10
Posts: 24
Rep:
/var/log/messages problem
In /var/log/messages, I'm getting lots of weird entries:
Code:
Mar 23 19:54:15 <censored> named[1319]: client 127.0.0.1#55094: query: com.com IN A +
Mar 23 19:55:15 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN AAAA +
Mar 23 19:55:15 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.199#53
Mar 23 19:55:15 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.198#53
Mar 23 19:55:15 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN AAAA +
Mar 23 19:55:15 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.198#53
Mar 23 19:55:15 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.199#53
Mar 23 19:55:15 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN AAAA +
Mar 23 19:55:16 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.199#53
Mar 23 19:55:16 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.198#53
Mar 23 19:55:16 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN AAAA +
Mar 23 19:55:16 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.198#53
Mar 23 19:55:16 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.199#53
Mar 23 19:55:16 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN A +
Mar 23 19:55:16 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN MX +
Mar 23 19:55:16 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.199#53
Mar 23 19:55:16 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.198#53
Mar 23 19:55:16 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN MX +
Mar 23 19:55:16 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.198#53
Mar 23 19:55:17 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.199#53
Mar 23 19:55:17 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN MX +
Mar 23 19:55:17 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.199#53
Mar 23 19:55:17 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.198#53
Mar 23 19:55:17 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN MX +
Mar 23 19:55:17 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.198#53
Mar 23 19:55:17 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.199#53
There are lots of other weird entries like this to other sites that are presumably spam:
Code:
Mar 23 19:07:06 <censored> named[1319]: client 82.165.148.17#3509: query: DBDIGITALSYSTEMS.COM IN A +
Mar 23 19:07:06 <censored> named[1319]: client 82.165.148.17#3510: query: RSTEDT.COM IN CNAME +
Mar 23 19:07:10 <censored> named[1319]: client 82.165.148.17#3973: query: UTEC-INT.COM IN A +
Mar 23 19:07:10 <censored> named[1319]: client 82.165.148.17#3974: query: JAUDODESIGN.COM IN CNAME +
Mar 23 19:07:10 <censored> named[1319]: client 82.165.148.17#4033: query: VOIP-PORTAL.NET IN A +
Mar 23 19:07:12 <censored> named[1319]: client 82.165.148.17#4196: query: FIRSTTIMEGAYSTORY.COM IN A +
Mar 23 19:07:12 <censored> named[1319]: client 82.165.148.17#4198: query: HBAILEN.COM IN CNAME +
Mar 23 19:07:12 <censored> named[1319]: client 82.165.148.17#4199: query: CALIFORNIAGUYZ.COM IN CNAME +
Mar 23 19:07:12 <censored> named[1319]: client 82.165.148.17#4200: query: SANTOSRESTORATION.COM IN A +
Mar 23 19:07:16 <censored> named[1319]: lame server resolving 'SANTOSRESTORATION.COM' (in 'SANTOSRESTORATION.com'?): 65.61.199.13#53
Mar 23 19:07:16 <censored> named[1319]: lame server resolving 'SANTOSRESTORATION.COM' (in 'SANTOSRESTORATION.com'?): 65.61.198.13#53
Mar 23 19:07:17 <censored> named[1319]: client 82.165.148.17#4826: query: DSTAXI.COM IN A +
Mar 23 19:07:31 <censored> named[1319]: client 82.165.148.17#2160: query: ALBERTLEA.NET IN A +
Mar 23 19:07:41 <censored> named[1319]: client 82.165.148.17#3313: query: PDQELECTRICAL.COM IN A +
Mar 23 19:07:41 <censored> named[1319]: client 82.165.148.17#3315: query: SONGICON.COM IN CNAME +
Mar 23 19:07:41 <censored> named[1319]: client 82.165.148.17#3316: query: MARKETCLEAR.NET IN CNAME +
Mar 23 19:07:41 <censored> named[1319]: client 82.165.148.17#3317: query: BAREKNUCKLEEXTREME.COM IN CNAME +
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'SONGICON.COM/CNAME/IN': 72.32.71.213#53
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'BAREKNUCKLEEXTREME.COM/CNAME/IN': 204.13.160.15#53
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'BAREKNUCKLEEXTREME.COM/CNAME/IN': 204.13.161.15#53
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'ns1.dsredirection.com/AAAA/IN': 204.13.160.15#53
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'ns2.dsredirection.COM/AAAA/IN': 204.13.160.15#53
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'ns1.dsredirection.com/AAAA/IN': 204.13.161.15#53
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'ns2.dsredirection.COM/AAAA/IN': 204.13.161.15#53
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'SONGICON.COM/CNAME/IN': 72.32.71.212#53
Could anyone tell me what on earth is happening here, and a quick summary of what each line means would be nice, too. Thanks.
Last edited by x42bn6; 03-23-2007 at 10:44 PM .
#2
Member
Registered: Jun 2004
Location: Nova Scotia, Canada!
Distribution: Ubuntu
Posts: 169
Rep:
Well, I'm not a BIND expert so I can't tell you what's wrong, specifically, but I can tell you that it's not spam. The 'named' daemon is your DNS server. You have some issues with your BIND setup.
#3
Senior Member
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658
Rep:
The FORMERR is a "FORMAT ERROR" message. Likely because you are trying to resolve IPv6 addresses (aka AAAA record). Try turning off IPv6 in both Named and your mail server.
#4
LQ Newbie
Registered: Oct 2006
Distribution: Ubuntu 9.10
Posts: 24
Original Poster
Rep:
The IP addresses are most likely not ours (some of them get lots of hits when I check their IPs on blacklists). The domains should tell the story - this server runs a forum.
#5
Senior Member
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658
Rep:
Quote:
Originally Posted by x42bn6
Would disabling IPv6 have any detrimental effects on this?
If you are not using an
IPv6 network, then it shouldn't cause any problems.
Thread Tools
Search this Thread
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
HTML code is Off
All times are GMT -5. The time now is 04:50 PM .
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know .
