RCODE (REFUSED)
Harry Putnam
reader at newsguy.com
Wed Mar 1 11:29:08 UTC 2006
Running bind-9.3.2
I'm seeing quite a few lines like this in logs:
(wrapped for mail)
Feb 28 22:15:14 reader named[28465]: unexpected RCODE (REFUSED)
resolving '60.206.94.211.in-addr.arpa/PTR/IN': 211.94.193.129#53
I might not have paid too much attention to that if it weren't for
this little item right next to it:
Feb 28 22:15:18 reader sshd[3335]: Invalid user admin from
211.94.206.60
This was a logsentry report, not the actual log so those lines
appeared next to each other.
Is the first a prelude in some way to an ssh hack of somekind?
More information about the bind-users
mailing list