Bind 4.9.7

[Dimitry Snezhkov]

Friends,

I am trying to figure out whether my DNS machine have been compromized.

I have the following on my system:
lr-xr-xr-t 1 root sys 24 Jul 29 2002 /usr/bin/hosts_to_named -> /usr/sbin/hosts_to_named
-r-xr-xr-x 1 bin bin 47818 Feb 7 2001 /usr/sbin/hosts_to_named

Why would default installation
have /usr/bin/hosts_to_named link?

Also, in named.boot I have many invalid primary entries.

Like:
primary 213.221.207.IN-ADDR.ARPA db.207.221.213
primary 198.222.207.IN-ADDR.ARPA db.207.222.198
primary 181.146.157.IN-ADDR.ARPA db.157.146.181
primary 8.168.192.IN-ADDR.ARPA db.192.168.8
primary 27.167.IN-ADDR.ARPA db.167.27
primary 111.99.15.IN-ADDR.ARPA db.15.99.111
primary 206.IN-ADDR.ARPA db.206
primary 242.4.10.IN-ADDR.ARPA db.10.4.242
primary 241.4.10.IN-ADDR.ARPA db.10.4.241
primary 130.29.172.IN-ADDR.ARPA db.172.29.130
primary 157.146.161.IN-ADDR.ARPA db.161.146.157
primary 161.146.157.IN-ADDR.ARPA db.157.146.161

Those are invalid!
However, there are no corresponding db.* files specified above.

Also, param file ( which hosts_to_named uses )
does contain invalid "-n"
entries :

-n 207.221.213
-n 207.222.198
-n 157.146.181
-n 157.146.161
-n 192.168.8
-n 167.27
-n 15.99.111

Also, syslog is full of

Feb 28 08:23:49 hp19rm2 named[578]: XSTATS 1046442229 1038702860 RR=1691106 RNXD=156082 RFwdR=369681 RDupR=2989 RFail=9225 RFErr=0 RErr=529 RAXFR=0 RLame=1158700 ROpts=0 SSysQ=184376 SAns=53908770 SFwdQ=378261 SDupQ=1363848 SErr=0 RQ=54321565 RIQ=6 RFwdQ=378261 RDupQ=24302 RTCP=40179 SFwdR=369681 SFail=125772 SFErr=21 SNaAns=513244 SNXD=10349958
Feb 28 08:29:11 hp19rm2 named[578]: ns_forw: query(155.12.98.63.in-addr.arpa) A RR negative cache entry (ns.prw.com:) learnt (NXDOMAIN=212.53.64.30:NS=198.6.1.83)
Feb 28 08:29:11 hp19rm2 named[578]: ns_forw: query(155.12.98.63.in-addr.arpa) No possible A RRs

If it's compromized, what are they trying to do, so I can fix it. I am in the process of upgrading to bind 9.

any information will be useful.
Thanks very much .
Dimitry

[Pete Randall · Accepted solution]

Dimitry,

I can, at least, verify that the link on hosts_to_named is normal (but mysterious). As to the rest, I'll leave it to others to speculate.

Pete

[Steven E. Protter]

If DNS queries are resolving correctly the syslog messages are annoying but can be ignored.

I get them too, BIND 9 is a much better place to be. That's what I'm doing with my new rp5450/L2000 servers.

SEP

[Dimitry Snezhkov]

I am not concerned w/syslog.
I would like to know how the invalid networks/hosts appear
to be in param file and therefore( or independent of)

in named.boot and wherether it's a nameserver glitch or deliberate act.
Thanks