Hi all,
For the first time my primary name server is not reporting any more
client XXX.XXX.XXX.XXX query (cache) './NS/IN' denied: 1 Time(s)
I use authfail on it to insert any IP attempting to ssh in, and failing more
than three times.
I checked the current blocked IP address from the NS1 (name server), against
the last list I saved, and this is the diff
> iptables -I INPUT -s 203.116.40.105/32 -j DROP
> iptables -I INPUT -s 75.98.70.11/32 -j DROP
> iptables -I INPUT -s 202.93.212.37/32 -j DROP
> iptables -I INPUT -s 41.222.10.230/32 -j DROP
> iptables -I INPUT -s 193.231.27.8/32 -j DROP
> iptables -I INPUT -s 75.102.10.231/32 -j DROP
> iptables -I INPUT -s 77.222.43.28/32 -j DROP
> iptables -I INPUT -s 67.205.103.187/32 -j DROP
> iptables -I INPUT -s 173.246.100.44/32 -j DROP
> iptables -I INPUT -s 147.102.208.41/32 -j DROP
> iptables -I INPUT -s 113.31.19.111/32 -j DROP
It has to be one or several of these IP address that are doing it. My NS2
(secondary name server) is still doing it. I'm going to upload the entire 3980
blocked IP's to it, and see if it stops. If it does, the offender has to be
somewhere in this list. :)
Is there also a good test to check and see if I can / am poisoned?
Hope this helps,
Shawn
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
