Re: [Sop.Tec.LinuxPPP] syslogd

[David Alfredo Daza Padron <ddaza en campus ruv itesm mx>]

Solo por aportar un comentario, no estaran tratandote de hacerte un
ataque DOS?

checa tu version de DNS y revisa si hay algun reporte de bug o DOS en
esa version
asi como el parche.

Daniel Torres wrote:
> 
> Que tal.
> 
> En los ultimos dias he notado que el proceso syslogd esta utilizando muchos
> recursos del sistema (a veces hasta el 99.8 % del procesador), y eso hace
> que el servidor sea muy lento. Obviamente al matar el proceso se normaliza
> la situacion.
> 
> Revisando en el archivos /var/log/messages encontre muchos mensajes aue
> comienzan con named[195], por ejemplo
> 
> Nov 12 17:38:10 bajio named[195]: Lame server on 'mediaelectronics.com.mx'
> (in 'mediaelectronics.com.mx'?): [207.249.90.253].53 'ns2.infoacces.net'
> Nov 12 17:38:11 bajio named[195]: Lame server on 'raq1.optiweb.org' (in
> 'optiweb.org'?): [192.42.93.30].53 'G.GTLD-SERVERS.NET'
> Nov 12 17:38:12 bajio named[195]: Lame server on 'raq1.optiweb.org' (in
> 'optiweb.org'?): [192.41.162.30].53 'L.GTLD-SERVERS.NET'
> Nov 12 17:38:14 bajio named[195]: Lame server on 'raq1.optiweb.org' (in
> 'optiweb.org'?): [192.35.51.30].53 'F.GTLD-SERVERS.NET'
> Nov 12 17:38:16 bajio named[195]: Lame server on 'raq1.optiweb.org' (in
> 'optiweb.org'?): [192.5.6.30].53 'A.GTLD-SERVERS.NET'
> Nov 12 17:38:17 bajio named[195]: Lame server on 'raq1.optiweb.org' (in
> 'optiweb.org'?): [192.54.112.30].53 'H.GTLD-SERVERS.NET'
> Nov 12 17:38:17 bajio in.pop3d[63]: connect from 200.56.84.211
> Nov 12 17:38:19 bajio named[195]: Lame server on 'raq1.optiweb.org' (in
> 'optiweb.org'?): [192.36.144.133].53 'I.GTLD-SERVERS.NET'
> Nov 12 17:38:21 bajio named[195]: Lame server on 'raq1.optiweb.org' (in
> 'optiweb.org'?): [192.33.14.30].53 'B.GTLD-SERVERS.NET'
> Nov 12 17:38:22 bajio named[195]: Lame server on 'raq1.optiweb.org' (in
> 'optiweb.org'?): [192.31.80.30].53 'D.GTLD-SERVERS.NET'
> Nov 12 17:38:23 bajio named[195]: Lame server on 'raq1.optiweb.org' (in
> 'optiweb.org'?): [210.132.100.101].53 'J.GTLD-SERVERS.NET'
> Nov 12 17:38:25 bajio named[195]: Lame server on 'raq1.optiweb.org' (in
> 'optiweb.org'?): [213.177.194.5].53 'K.GTLD-SERVERS.NET'
> Nov 12 17:38:27 bajio named[195]: Lame server on 'raq1.optiweb.org' (in
> 'optiweb.org'?): [192.12.94.30].53 'E.GTLD-SERVERS.NET'
> Nov 12 17:38:28 bajio named[195]: Lame server on 'raq1.optiweb.org' (in
> 'optiweb.org'?): [202.153.114.101].53 'M.GTLD-SERVERS.NET'
> Nov 12 17:30:20 bajio named[195]: "PROGNET.com IN NS" points to a CNAME
> (murrow.PROGNET.com)
> Nov 12 17:30:20 bajio named[195]: reloading nameserver
> Nov 12 17:30:20 bajio named[195]: owner name "#RINFONET.mayanet.com.mx" IN
> (primary) is invalid - rejecting
> Nov 12 17:30:20 bajio named[195]: mayanet.com.mx:21: owner name error
> Nov 12 17:30:20 bajio named[195]: mayanet.com.mx:21: Database error (a)
> Nov 12 17:30:22 bajio named[195]: owner name "#www.desmex.com.mx" IN
> (primary) is invalid - rejecting
> Nov 12 17:30:22 bajio named[195]: quinnmexico.com.mx:18: owner name error
> Nov 12 17:30:22 bajio named[195]: quinnmexico.com.mx:18: Database error (a)
> Nov 12 17:30:27 bajio in.pop3d[32604]: connect from 200.64.253.154
> Nov 12 17:30:22 bajio named[195]: desmex.com.mx:19: data
> "www.quinnmexico.com" outside zone "desmex.com.mx" (ignored)
> Nov 12 17:30:22 bajio named[195]: desmex.com.mx:21: data "region.iep.org.mx"
> outside zone "desmex.com.mx" (ignored)
> Nov 12 17:30:22 bajio named[195]: master zone "desmex.com.mx" (IN) loaded
> (serial 10134)
> Nov 12 17:30:22 bajio named[195]: owner name "#www.desmex.com.mx" IN
> (primary) is invalid - rejecting
> Nov 12 17:30:22 bajio named[195]: iep.org.mx:17: owner name error
> Nov 12 17:30:22 bajio named[195]: iep.org.mx:17: Database error (a)
> Nov 12 17:30:22 bajio named[195]: iep.org.mx:18: data "www.quinnmexico.com"
> outside zone "iep.org.mx" (ignored)
> Nov 12 17:30:25 bajio named[195]: Forwarding source address is
> [0.0.0.0].1815
> Nov 12 17:30:25 bajio named[195]: Ready to answer queries.
> Nov 12 17:30:25 bajio named[195]: reloading nameserver
> Nov 12 17:30:25 bajio named[195]: owner name "#RINFONET.mayanet.com.mx" IN
> (primary) is invalid - rejecting
> Nov 12 17:30:25 bajio named[195]: mayanet.com.mx:21: owner name error
> Nov 12 17:30:25 bajio named[195]: mayanet.com.mx:21: Database error (a)
> Nov 12 17:30:25 bajio named[195]: owner name "#www.desmex.com.mx" IN
> (primary) is invalid - rejecting
> Nov 12 17:30:25 bajio named[195]: quinnmexico.com.mx:18: owner name error
> Nov 12 17:30:25 bajio named[195]: quinnmexico.com.mx:18: Database error (a)
> Nov 12 17:30:25 bajio named[195]: owner name "#www.desmex.com.mx" IN
> (primary) is invalid - rejecting
> Nov 12 17:30:25 bajio named[195]: iep.org.mx:17: owner name error
> Nov 12 17:30:25 bajio named[195]: iep.org.mx:17: Database error (a)
> 
> a que se debera este problema? hay algo mal con el named???
> 
> Gracias..
> ---------------------------------------------------------------------
> Lista de soporte de LinuxPPP
>  Reglas de la lista en http://linuxppp.com/reglas.html

-- 
Ing. David Alfredo Daza Padron
Proyectos y Nuevas Tecnologias
Computo Central - Universidad Virtual ITESM 
Tel (52)(81) 8387 2818, 4580 ext. 351
Tel Dir. 81552581
Monterrey, Nuevo Leon MEXICO
---------------------------------------------------------------------
Lista de soporte de LinuxPPP
 Reglas de la lista en http://linuxppp.com/reglas.html