Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here. |
| Notices |
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
 |
GNU/Linux Basic Guide
This 255-page guide will provide you with the keys to understand the philosophy of free software, teach you how to use and handle it, and give you the tools required to move easily in the world of GNU/Linux. Many users and administrators will be taking their first steps with this GNU/Linux Basic guide and it will show you how to approach and solve the problems you encounter.
Click Here to receive this Complete Guide absolutely free. |
|
 |
03-23-2007, 10:30 PM
|
#1
|
|
LQ Newbie
Registered: Oct 2006
Distribution: Ubuntu 9.10
Posts: 24
Rep: 
|
/var/log/messages problem
In /var/log/messages, I'm getting lots of weird entries:
Code:
Mar 23 19:54:15 <censored> named[1319]: client 127.0.0.1#55094: query: com.com IN A +
Mar 23 19:55:15 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN AAAA +
Mar 23 19:55:15 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.199#53
Mar 23 19:55:15 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.198#53
Mar 23 19:55:15 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN AAAA +
Mar 23 19:55:15 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.198#53
Mar 23 19:55:15 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.199#53
Mar 23 19:55:15 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN AAAA +
Mar 23 19:55:16 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.199#53
Mar 23 19:55:16 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.198#53
Mar 23 19:55:16 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN AAAA +
Mar 23 19:55:16 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.198#53
Mar 23 19:55:16 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/AAAA/IN': 195.50.105.199#53
Mar 23 19:55:16 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN A +
Mar 23 19:55:16 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN MX +
Mar 23 19:55:16 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.199#53
Mar 23 19:55:16 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.198#53
Mar 23 19:55:16 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN MX +
Mar 23 19:55:16 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.198#53
Mar 23 19:55:17 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.199#53
Mar 23 19:55:17 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN MX +
Mar 23 19:55:17 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.199#53
Mar 23 19:55:17 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.198#53
Mar 23 19:55:17 <censored> named[1319]: client 127.0.0.1#55094: query: gondasnailart.com IN MX +
Mar 23 19:55:17 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.198#53
Mar 23 19:55:17 <censored> named[1319]: FORMERR resolving 'gondasnailart.com/MX/IN': 195.50.105.199#53
There are lots of other weird entries like this to other sites that are presumably spam:
Code:
Mar 23 19:07:06 <censored> named[1319]: client 82.165.148.17#3509: query: DBDIGITALSYSTEMS.COM IN A +
Mar 23 19:07:06 <censored> named[1319]: client 82.165.148.17#3510: query: RSTEDT.COM IN CNAME +
Mar 23 19:07:10 <censored> named[1319]: client 82.165.148.17#3973: query: UTEC-INT.COM IN A +
Mar 23 19:07:10 <censored> named[1319]: client 82.165.148.17#3974: query: JAUDODESIGN.COM IN CNAME +
Mar 23 19:07:10 <censored> named[1319]: client 82.165.148.17#4033: query: VOIP-PORTAL.NET IN A +
Mar 23 19:07:12 <censored> named[1319]: client 82.165.148.17#4196: query: FIRSTTIMEGAYSTORY.COM IN A +
Mar 23 19:07:12 <censored> named[1319]: client 82.165.148.17#4198: query: HBAILEN.COM IN CNAME +
Mar 23 19:07:12 <censored> named[1319]: client 82.165.148.17#4199: query: CALIFORNIAGUYZ.COM IN CNAME +
Mar 23 19:07:12 <censored> named[1319]: client 82.165.148.17#4200: query: SANTOSRESTORATION.COM IN A +
Mar 23 19:07:16 <censored> named[1319]: lame server resolving 'SANTOSRESTORATION.COM' (in 'SANTOSRESTORATION.com'?): 65.61.199.13#53
Mar 23 19:07:16 <censored> named[1319]: lame server resolving 'SANTOSRESTORATION.COM' (in 'SANTOSRESTORATION.com'?): 65.61.198.13#53
Mar 23 19:07:17 <censored> named[1319]: client 82.165.148.17#4826: query: DSTAXI.COM IN A +
Mar 23 19:07:31 <censored> named[1319]: client 82.165.148.17#2160: query: ALBERTLEA.NET IN A +
Mar 23 19:07:41 <censored> named[1319]: client 82.165.148.17#3313: query: PDQELECTRICAL.COM IN A +
Mar 23 19:07:41 <censored> named[1319]: client 82.165.148.17#3315: query: SONGICON.COM IN CNAME +
Mar 23 19:07:41 <censored> named[1319]: client 82.165.148.17#3316: query: MARKETCLEAR.NET IN CNAME +
Mar 23 19:07:41 <censored> named[1319]: client 82.165.148.17#3317: query: BAREKNUCKLEEXTREME.COM IN CNAME +
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'SONGICON.COM/CNAME/IN': 72.32.71.213#53
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'BAREKNUCKLEEXTREME.COM/CNAME/IN': 204.13.160.15#53
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'BAREKNUCKLEEXTREME.COM/CNAME/IN': 204.13.161.15#53
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'ns1.dsredirection.com/AAAA/IN': 204.13.160.15#53
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'ns2.dsredirection.COM/AAAA/IN': 204.13.160.15#53
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'ns1.dsredirection.com/AAAA/IN': 204.13.161.15#53
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'ns2.dsredirection.COM/AAAA/IN': 204.13.161.15#53
Mar 23 19:07:45 <censored> named[1319]: FORMERR resolving 'SONGICON.COM/CNAME/IN': 72.32.71.212#53
Could anyone tell me what on earth is happening here, and a quick summary of what each line means would be nice, too. Thanks.
Last edited by x42bn6; 03-23-2007 at 10:44 PM.
|
|
|
|
|
03-24-2007, 12:40 AM
|
#2
|
|
Member
Registered: Jun 2004
Location: Nova Scotia, Canada!
Distribution: Ubuntu
Posts: 170
Rep:
|
Well, I'm not a BIND expert so I can't tell you what's wrong, specifically, but I can tell you that it's not spam. The 'named' daemon is your DNS server. You have some issues with your BIND setup.
I'll let someone who actually knows something about BIND comment on what the specific problem may be.
|
|
|
|
|
03-24-2007, 11:28 AM
|
#3
|
|
Senior Member
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658
Rep:
|
The FORMERR is a "FORMAT ERROR" message. Likely because you are trying to resolve IPv6 addresses (aka AAAA record). Try turning off IPv6 in both Named and your mail server.
There also appears to be a problem resolving MX (mail exchange) records. Not sure why that is occurring.
Do the IP addresses belong to your network or are they unknown remote hosts?
|
|
|
|
|
03-24-2007, 01:33 PM
|
#4
|
|
LQ Newbie
Registered: Oct 2006
Distribution: Ubuntu 9.10
Posts: 24
Original Poster
Rep:
|
The IP addresses are most likely not ours (some of them get lots of hits when I check their IPs on blacklists). The domains should tell the story - this server runs a forum.
Would disabling IPv6 have any detrimental effects on this?
|
|
|
|
|
03-24-2007, 07:04 PM
|
#5
|
|
Senior Member
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658
Rep:
|
Quote:
|
Originally Posted by x42bn6
Would disabling IPv6 have any detrimental effects on this?
|
If you are not using an IPv6 network, then it shouldn't cause any problems. |
|
|
|
| Thread Tools |
Search this Thread |
|
|
|
Posting Rules
|
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
HTML code is Off
|
|
|
All times are GMT -5. The time now is 11:36 PM.
|
|
|
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
|
|
 Latest Threads
LQ News
|
|
