Error messages in /var/log/messages
Mark.Andrews at nominum.com
Mark.Andrews at nominum.com
Fri May 4 23:26:49 UTC 2001
The error messages also indicate that you are running a
version of named with known security flaws. See:
http://www.isc.org/products/BIND/bind-security.html
Mark
>
> I wouldn't think it was a hack attempt. I think
> it is a misconfigured machine. The address it is
> coming from looks like a uunet dial-up account. I
> would guess that someone configured a laptop
> internally and then took it on the road.
>
>
> > -----Original Message-----
> > From: bind-users-bounce at isc.org [mailto:bind-users-bounce at isc.org]On
> > Behalf Of Kayvan A. Sylvan
> > Sent: Friday, May 04, 2001 11:47 AM
> > To: bind-users at isc.org
> > Subject: Error messages in /var/log/messages
> >
> >
> >
> > Does anyone know what this is? It looks like a hack attempt:
> >
> > Apr 29 04:04:26 satyr named[1449]: unapproved update from
> > [63.16.250.83].16989 for sylvan.com
> > Apr 29 04:05:31 satyr named[1449]: unapproved update from
> > [63.16.250.83].17001 for sylvan.com
> > Apr 29 04:06:34 satyr named[1449]: unapproved update from
> > [63.16.250.83].17011 for sylvan.com
> > [...]
> > Apr 29 06:25:49 satyr named[1449]: unapproved update from
> > [63.16.250.77].18761 for sylvan.com
> > Apr 29 06:26:53 satyr named[1449]: unapproved update from
> > [63.16.250.77].18774 for sylvan.com
> > Apr 29 06:27:58 satyr named[1449]: unapproved update from
> > [63.16.250.77].18789 for sylvan.com
> > [...]
> > May 4 08:16:08 satyr named[1449]: unapproved update from
> > [63.16.250.118].60233 for sylvan.com
> > May 4 08:17:21 satyr named[1449]: unapproved update from
> > [63.16.250.118].60246 for sylvan.com
> > May 4 08:18:37 satyr named[1449]: unapproved update from
> > [63.16.250.118].60265 for sylvan.com
> > May 4 08:21:26 satyr named[1449]: unapproved update from
> > [63.16.250.105].60441 for sylvan.com
> > May 4 08:21:27 satyr named[1449]: unapproved update from
> > [63.16.250.105].60470 for sylvan.com
> > May 4 08:21:27 satyr named[1449]: unapproved update from
> > [63.16.250.105].60479 for sylvan.com
> > May 4 08:21:27 satyr named[1449]: unapproved update from
> > [63.16.250.105].60482 for sylvan.com
> > May 4 08:21:27 satyr named[1449]: unapproved update from
> > [63.16.250.105].60484 for sylvan.com
> > May 4 08:21:32 satyr named[1449]: unapproved update from
> > [63.16.250.105].60525 for sylvan.com
> > May 4 08:21:33 satyr named[1449]: unapproved update from
> > [63.16.250.105].60533 for sylvan.com
> > May 4 08:22:31 satyr named[1449]: unapproved update from
> > [63.16.250.105].60562 for sylvan.com
> > May 4 08:23:36 satyr named[1449]: unapproved update from
> > [63.16.250.105].60581 for sylvan.com
> > May 4 08:24:40 satyr named[1449]: unapproved update from
> > [63.16.250.105].60591 for sylvan.com
> > May 4 08:25:44 satyr named[1449]: unapproved update from
> > [63.16.250.105].60602 for sylvan.com
> > May 4 08:26:48 satyr named[1449]: unapproved update from
> > [63.16.250.105].60612 for sylvan.com
> > May 4 08:27:53 satyr named[1449]: unapproved update from
> > [63.16.250.105].60623 for sylvan.com
> > May 4 08:28:59 satyr named[1449]: unapproved update from
> > [63.16.250.105].60645 for sylvan.com
> > May 4 08:30:04 satyr named[1449]: unapproved update from
> > [63.16.250.105].60656 for sylvan.com
> > May 4 08:31:11 satyr named[1449]: unapproved update from
> > [63.16.250.105].60667 for sylvan.com
> > May 4 08:32:14 satyr named[1449]: unapproved update from
> > [63.16.250.105].60677 for sylvan.com
> > May 4 08:33:18 satyr named[1449]: unapproved update from
> > [63.16.250.105].60693 for sylvan.com
> > May 4 08:34:22 satyr named[1449]: unapproved update from
> > [63.16.250.105].60708 for sylvan.com
> > May 4 08:35:26 satyr named[1449]: unapproved update from
> > [63.16.250.105].60719 for sylvan.com
> > May 4 08:36:30 satyr named[1449]: unapproved update from
> > [63.16.250.105].60729 for sylvan.com
> > May 4 08:37:34 satyr named[1449]: unapproved update from
> > [63.16.250.105].60740 for sylvan.com
> > May 4 08:38:38 satyr named[1449]: unapproved update from
> > [63.16.250.105].60753 for sylvan.com
> > May 4 08:39:42 satyr named[1449]: unapproved update from
> > [63.16.250.105].60764 for sylvan.com
> > May 4 08:40:46 satyr named[1449]: unapproved update from
> > [63.16.250.105].60774 for sylvan.com
> > May 4 08:41:50 satyr named[1449]: unapproved update from
> > [63.16.250.105].60787 for sylvan.com
> > May 4 08:42:54 satyr named[1449]: unapproved update from
> > [63.16.250.105].60797 for sylvan.com
> > May 4 08:43:57 satyr named[1449]: unapproved update from
> > [63.16.250.105].60811 for sylvan.com
> >
> > --
> > Kayvan A. Sylvan | Proud husband of |
> > Father to my kids:
> > Sylvan Associates, Inc. | Laura Isabella Sylvan |
> > Katherine Yelena
> > http://www.successlinks.com/kayvan | Reach your goals now! |
> > Robin Gregory
> >
>
--
Mark Andrews, Nominum Inc.
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: Mark.Andrews at nominum.com
More information about the bind-users
mailing list