Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Has any one every faced this ?

[oc3]

Hello gang,
well i have a very wired problem at hand with BIND 9

it was working fine till 2 days a go, but from last 48 hours, my bind has restarted 2 twice,, and gave me a lag of 7 mins - 10 mins each time. And this happens at a specific time.

Any clues to what could be the problem, in case if some one wants to see my log's i m willling to share it any one.

Regards/-

[oc3]

Hello,

Any one Please ?

[Joe Kellner]

What specific version? There are alot of versions of bind 9 floating around. What OS? What system? etc.etc. Not enough information posted. Feel free to post any relevant logs regarding the named proccess.

[oc3]

Hi thanks a lot

I m using RH 7.2,Kernel
enterprise kernel 2.4.9

Ok i m using bind 9.2.1
what else do u need please let me know !!

and one more thing a few mins b4 even my apache restarted. Idont know whats happening ?

Please !!!!

[Joe Kellner]

named -v will give you the version in 8.x and 9.x..apache restarts during monthy(weekly?) log rotation. Are you sure someone isnt "administrating" your system?

[oc3]

Hi,
this is a very new server with just one client on it,
and no i havent given any one any kind of SSH access to my server..although i recv a lot of winnt hack attempts, and my Apache just restarted for the very first time on its own

I tried using this command to Deny that ip. could u tell me whether it is correct or not

/sbin/iptables -A input -s 66.7.85.187/255.255.255.255 -d 0.0.0.0/0.0.0.0 -j DENY

coz when i issue this i get this error

iptables v1.2.4: Couldn't load target `DENY':/lib/iptables/libipt_DENY.so: cannot open shared object file: No such file or directory

Any suggestion
Thanks

[Joe Kellner]

I would do:

iptables -A INPUT -s 66.7.85.0/24 -d 0/0 -j REJECT

Which gives you:

Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT all -- 66.7.85.0/24 anywhere reject-with icmp-port-unreachable



I believe DENY is deprecated in iptables, replaced with REJECT and DROP.

[oc3]

hi, thanks yeh this command worked well,

iptables -A INPUT -s 66.7.85.0/24 -d 0/0 -j DROP,

But could u also tell me why do i have Bind and Apache Failure ?

In case if u want to see my /var/log/messages, i m willling to mail you, just let me know your email id

Regards/

[Joe Kellner]

Originally posted by oc3
hi, thanks yeh this command worked well,

iptables -A INPUT -s 66.7.85.0/24 -d 0/0 -j DROP,

But could u also tell me why do i have Bind and Apache Failure ?

In case if u want to see my /var/log/messages, i m willling to mail you, just let me know your email id

Regards/

jdk at kingsmeade dot net

[oc3]

Ok, i have mailed you.
One more thing, in my WHM/when i click apache status i have one entry showing this almost always..

"GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN"

could u tell me what is this ?

Thanks/-

[Joe Kellner]

Originally posted by oc3
Ok, i have mailed you.
One more thing, in my WHM/when i click apache status i have one entry showing this almost always..

"GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN"

could u tell me what is this ?

Thanks/-

I forgot, I think it's CodeRed.Whatever it is, it's some stupid IIS exploit for windows, nothing to worry about on a unix system running apache.

As far as the log file you sent me..I don't see anything *too* out of the ordinary for a busy server

[oc3]

Hello JDK,

Thanks a lot, but the problem is, this is a very fresh server and no clients et all. and this should not be like this, is there any thing else that i should check. Coz today Bind did not start,but on the contrary Apache restared twice. this is wired.

Regards/-