LinuxQuestions.org - named (bind) curiosity: syslog full of this similar messages

- Slackware (https://www.linuxquestions.org/questions/slackware-14/)

- - named (bind) curiosity: syslog full of this similar messages (https://www.linuxquestions.org/questions/slackware-14/named-bind-curiosity-syslog-full-of-this-similar-messages-478582/)

named (bind) curiosity: syslog full of this similar messages

Hi all,
I have been running since two months ago a Slackware 10.2 server with some services online, including ftp, apache, mail and DNS with a bunch of registered domains. Everything fine :p

While watching at the logs, I've noticed that /var/log/syslog is damn full of this kind of messages (I modified the green parts for privacy/security reasons):

Quote:

Aug 29 17:33:01 hostname named[pid]: client 190.52.128.63#64053: update 'mydomain.com/IN' denied

All the messages are alike. All of them include a client IP telling me that the server denied an update on one of my domains.

I did some gogglish research and here, I found a text that tries to explain that the name server is doing (not the proper version but seems fit)

Quote:

Indicates that your name server refused a dynamic update to the zone 174.132.in-addr.arpa from the host at IP address 132.174.25.169.

I'm not a network guy, so I can't catch the whole idea yet, that's why I need some advice here.
What is a dynamic update?

I guess it is ok to denied them, for security's sake (or something...)
While going online, a consultant and friend of mine suggested that I should add these options in the /etc/named.conf file:

Code:

options {

        directory      "/var/named";

        auth-nxdomain  yes;

        allow-transfer { 127.0.0.1; };

};

So the allow-transfer part there were the default one for all the configured domains.

What am I denying?

Here, those error messages are caused by Windows boxes using DHCP with the "Register this connection's addresses in DNS" flag set under Advanced TCP/IP Settings (on the DNS tab). I'd expect any DHCP set up to have that option somewhere.

The allow-transfer { 127.0.0.1; }; statement just means that nobody can transfer the zone information from the server. You may also be restricting with the allow-update and/or allow-update-forwarding statement (or it's the default, I'm not sure) which is why the update requests are causing the error message.

There's some info on the named.conf settings at http://www.zytrax.com/books/dns/ch7/ - it includes sections on all of the available settings.

Hi
Thanks for pointing me out, that link was just what I needed.
Seems that the allow-update { none; }; is the default for all the zones so it should be secure enough to satisfy my worst paranoid nightmares.

It seems that I should blame those windoze boxes for everything...

Quote:

Originally Posted by raska

It seems that I should blame those windoze boxes for everything...

Yes, and I think that would be a good policy, generally :p

Yeah, but management won't let me have such thing as a general company policy.
Here, most of the Computing Systems / Informatics department uses windoze for everyday tasks (not me :p)