hosts.allow

[kalin mintchev]

hi all...

i have some crap in my log like:

Feb 23 16:56:45 bigdaddy named[85641]: client 218.19.160.163#63869: update
'bigdaddy.com/IN' denied
Feb 23 16:56:46 bigdaddy named[85641]: client 218.19.160.163#62855: update
'bigdaddy.com/IN' denied
Feb 23 17:02:10 bigdaddy named[85641]: client 218.19.160.163#63999: update
'bigdaddy.com/IN' denied
Feb 23 17:16:20 bigdaddy named[85641]: client 218.19.160.163#62723: update
'bigdaddy.com/IN' denied
Feb 23 17:16:59 bigdaddy named[85641]: client 218.19.160.163#63975: update
'bigdaddy.com/IN' denied
Feb 23 17:20:38 bigdaddy named[85641]: client 218.19.160.163#63873: update
'bigdaddy.com/IN' denied
Feb 23 17:21:05 bigdaddy named[85641]: client 218.19.160.163#64057: update
'bigdaddy.com/IN' denied


so i put:

ALL : 218.19.160.163 : deny

in my hosts.allow but i still get that log piling up....

isn't the that line in hosts.allow avoiding that? should i restart something?


thanks...

--

[Dan Nelson]

In the last episode (Feb 23), kalin mintchev said:

> i have some crap in my log like:
>
> Feb 23 16:56:45 bigdaddy named[85641]: client 218.19.160.163#63869: update 'bigdaddy.com/IN' denied
> Feb 23 16:56:46 bigdaddy named[85641]: client 218.19.160.163#62855: update 'bigdaddy.com/IN' denied
> Feb 23 17:02:10 bigdaddy named[85641]: client 218.19.160.163#63999: update 'bigdaddy.com/IN' denied
> Feb 23 17:16:20 bigdaddy named[85641]: client 218.19.160.163#62723: update 'bigdaddy.com/IN' denied
> Feb 23 17:16:59 bigdaddy named[85641]: client 218.19.160.163#63975: update 'bigdaddy.com/IN' denied
> Feb 23 17:20:38 bigdaddy named[85641]: client 218.19.160.163#63873: update 'bigdaddy.com/IN' denied
> Feb 23 17:21:05 bigdaddy named[85641]: client 218.19.160.163#64057: update 'bigdaddy.com/IN' denied
>
> so i put:
>
> ALL : 218.19.160.163 : deny
>
> in my hosts.allow but i still get that log piling up....

Named isn't built with tcpwrapper support; it would probably cause too
much overhead. Chances are the machine at 218.19.160.163 is a windows
XP machine at your location, with Dynamic DNS updating enabled. Just
go into the TCP/IP prefs and disable it.

--
Dan Nelson
[email]dnelson@allantgroup.com[/email]

[kalin mintchev]

>> Feb 23 17:21:05 bigdaddy named[85641]: client 218.19.160.163#64057:

>> update 'bigdaddy.com/IN' denied
>>
>> so i put:
>>
>> ALL : 218.19.160.163 : deny
>>
>> in my hosts.allow but i still get that log piling up....

>
> Named isn't built with tcpwrapper support; it would probably cause too
> much overhead. Chances are the machine at 218.19.160.163 is a windows
> XP machine at your location, with Dynamic DNS updating enabled. Just
> go into the TCP/IP prefs and disable it.

no such chances. the machine is not on my local network. on the network
where this machine is there is no windows machines. and the 218.19.160.163
is somewhere in china....

is there any other way to block it? except ipfw rules...

thanks....

>
> --
> Dan Nelson
> [email]dnelson@allantgroup.com[/email]
> _______________________________________________
> [email]freebsd-questions@freebsd.org[/email] mailing list
> [url]http://lists.freebsd.org/mailman/listinfo/freebsd-questions[/url]
> To unsubscribe, send any mail to
> "freebsd-questions-unsubscribe@freebsd.org"
>

--

[Jeff With]

On Wed, 23 Feb 2005 19:20:11 -0500 (EST), kalin mintchev <kalin@el.net> wrote:

> >> Feb 23 17:21:05 bigdaddy named[85641]: client 218.19.160.163#64057:

> no such chances. the machine is not on my local network. on the network
> where this machine is there is no windows machines. and the 218.19.160.163
> is somewhere in china....
>
> is there any other way to block it? except ipfw rules...
>

BIND version 9.x (not sure on the exact version) and up supports ACLs.

example named.conf

acl china {
218.19.160.163; } ;

options {
blackhole {china;};
};

- jeff

[kalin mintchev]

> BIND version 9.x (not sure on the exact version) and up supports ACLs.
>
> example named.conf
>
> acl china {
> 218.19.160.163; } ;
>
> options {
> blackhole {china;};
> };

thanks ... that looks like a solution...

>
> - jeff
>

--