Hi. I posted before about our server. We fixed one problem..and it's been good for awhile, but now we're getting more strange queries:

Here's an example:

That's just a handful of odd queries. I'm not a techie, nor am I knowledgable on security, but I do run a linux desktop and know my way around.

Anyway, I was wondering, should we be worried about these queries? What are they?

Thanks.
-RoaCh

For part of it, it looks like someone mistyped gmail in the server's web browser. named is the DNS daemon.

It is used to host our forum.
Let me guess, it's PHP-based?

Aw, well, named.log probably is nothing to worry about, my question would be: why is BIND looking for MX records and especially for domains you (probably) have nothing to do with like "askasalesrep"? If there are no exploitable holes in anything (publicly) accessable you run and you do watch logs and regularly audit the system then the explanation could be found in running something that needs MX lookups like an anti-spam solution. A quick way to see the top-30 domains requested from your named.log:

Minor nit: if BIND is configured to check for IPv6 (the quad-A forward lookups) but you don't use IPv6 then why waste time on it?

mostly ipv4 and ipv6 'A' queries going on. something (if not you) is going to the internet by name. can you turn named off ?

I'm totally new to Linux and stuff and I do not feel ashamed to say, "I don't know what the heck you just said."
NP, that's what we're here for, right?


This server doesn't send emails out unless they are the confirmation emails or members sending emails to each other via our system. Granted, there are members with email addresses ending in askasalesrep.com (1 member) and gmial.com (1 member), but both are not likely to be receiving email via our system.
OK, so at least the lookups for those domains is linked to membership.


Is it possible we have been compromised and someone is mass-sending out emails?
If you have any doubt then it would be a mistake for me to say "no problem" without you verifying the system and presenting "evidence" (even though no clear signs of intrusion where presented). It would be in your own interest to verify your system looking at the contents of the temp dirs, (changes in) the system auth, anything suspicious from the system and daemon logs, verbose process and network listings, your package management tools in package verification mode, any file integrity checker (if installed), Chkrootkit or Rootkit Hunter, and to make sure you get the "basics" the steps from say the Intruder Detection Checklist (CERT): http://www.cert.org/tech_tips/intrud...checklist.html. Post your results back RSN.

Most likely it is not a compromise, and if it is it may wel be confined to something piggybacking PHP, but making sure is the only way to deal with this.