DNS Question
 

Hey Chap,

Hope you're all well and had a cracking Easter etc.

I have a quick question, I think it's nothing to worry about but I'd like to ask for some advice if I may.

I have recently built a couple of Bind 9 DNS Servers to replace our Windows public nameservers. I'm in the final stages of testing and everything is looking good.. however this morning I took a look in /var/log/messages and discovered the following:

...this is just a snippet there are loads.

I suspect this is just web bots / hackers attempting to transfer the zone file using nslookup or something? And the server is denying it, so it's doing it's job, but is it something to worry about?

Also, to be thorough I ran a TCP Dump on the box just now and I'm seeing a lot of random queries come in:

...again just a snippet.

Again I assume this is just random broadcast traffic, but the reason I question it is that this server is not authoritative yet and hasn't been listed by our registrar... So, is it just that the web bots or something have discovered a new live server on our range and are just playing?

Any advice appreciated.

Thanks
Jon

Do you have dynamic DNS enabled for this DNS server? Messages appear to be because of that. What it is saying it denied the update for obvious reason because the machine which tried to update doesn't match the TSIG keys and DNS didn't allow it to update, fair enough. My question is why you need DDNS on public DNS server? They wouldn't be able to update but they can definitely fill your log file for no reason. This is something you would like to check in your DNS config if you have DDNS enabled.

Yes web bots do perform check, I have seen them doing for my website but you have to see the pattern. If they are doing once in a while that is fine but if it is excess then there is a problem.

In the dump logs I can see they are trying to perform resolution for your hosts and not for any other hosts. I hope you have recursion disabled on the server just to avoid it being doomed by excessive queries from someone.

Hey,

Thanks for the reply...

This is what my conf looks like, I've not enabled ddns and recursion is off, as it's authoritative.. but should I explicitly set ddns to off? Is it on by default?


Notify and transfer is configured on a per zone basis as below:

UPDATE:

I added the following to the global options:

However a quick check of the logs shows that it's done nothing... Still getting denied updates.

Am I right in saying that if it were DDNS causing this issue that, the above mentioned directive in the conf should stop it from happening?

Another update:

Looking at things closer and just to be thorough, I've added the added to following to global conf:

If I remember correctly the zone options over-ride the global options? So, allow-transfer { x.x.x.x; }; - should still allow transfers to the slave?? Although as I'm typing I guess I don't really need to add allow-transfer to each zone as the slave is a listed NS in SOA so zone transfers would happen anyway when the zone expires?

Thanks
Jon

Apologies for the spamming of replies.. just wanted to let you know that the above did not resolve this either..

By default in bind9 allow update is set to none so you don't have to specify it explicitly. If you don't have DDNS enabled as I can see from the conf file you don't have to worry.

I might be mistaken but I have seen similar kind of entries 2-3 years back in one of my infra wherein we had DDNS enabled and DHCP was trying to update entry for the zone which it wasn't authorized for.

Incase log file is growing big you might want to configure logrotate to be more stringent.

Ah ok, thanks.. I suspected that it was not set to allow by default.

So any other ideas as to what could be causing this? Because it doesn't look right, these are being logged every 3-5 minutes.

You might want to check your DNS here: http://dnscheck.pingdom.com/

Also it will be a good idea to check with ISP on why you getting such excessive request. I have done a random check on the IPs which accessed this server and they are from UK. Some were from councils and some were from ISP. So, it will be a good idea to check with your ISP on this.

You said that you are moving from Windows to Linux DNS servers. Have your ever seen such stuff with Windows DNS. Did you check with registrar if this is due to the fact the name servers are still not made authoritative for your domain? Though I doubt it will make a difference because the log entries are for your domain if I am not wrong but still a check which you can perform.

Um, those "clients" are trying to update your zone (as in, misconfigured DDNS client). Have you found out what they are? Are they yours or someone else's?

Hey,

Sorry for the delay..

I never did figure out what was happening there, just assumed that as they are being denied I guess it's not causing that much of an issue.

They aren't our clients, they look to be from varying places..

Strange right?