any idea how to suppress this? this is centos 5.latest with bind 9.7

A local override, copy the named conf and move the regex that is counting those events up to the ignore section.

On 03/13/2014 12:17 PM, John R Pierce wrote:

ever since implementing the no-recursion-on-outside queries fix on one of my name servers, my logwatch emails have been 10-20MB/day, filled with crud like...

  client 10.191.192.212 query (cache) 'm.777.liyuanxi.com/A/IN' denied: 1 Time(s)
  client 10.192.34.96 query (cache) 'dyjwntl.www.0411gogo.com/A/IN' denied: 1 Time(s)
  client 10.192.43.105 query (cache) 'doitxwx.777.liyuanxi.com/A/IN' denied: 1 Time(s)
  client 10.192.90.161 query (cache) 'v.www.90uc.com/A/IN' denied: 1 Time(s)

any idea how to suppress this? this is centos 5.latest with bind 9.7

I added this to Named config:

channel security_file { file "/var/log/named/security.log" versions 3 size 30m; severity dynamic; print-time yes; };

And applied fail2ban:

jail.local:

IMPORTANT: see filter.d/named-refused for instructions to enable logging # This jail blocks TCP traffic for DNS requests. [named-refused-udp] enabled = true filter = named-refused action = shorewall sendmail[name=Named-udp, dest=admin@mail, sender=chiron@mail, sendername="Fail2Ban-named-re fused-udp"] #action = iptables-multiport[name=Named, port="domain,953", protocol=udp] # sendmail-whois[name=Named, dest=admin@mail] logpath=/var/log/named/security.log ignoreip = 168.192.0.0/16 172.16.0.0/12 10.0.0.0/8 publicsub/29

# This jail blocks TCP traffic for DNS requests. [named-refused-tcp] enabled = true filter = named-refused action = shorewall sendmail[name=Named-tcp, dest=admin@mail, sender=chiron@plnet.rs, sendername="Fail2Ban-named-re fused-tcp"] #action = iptables-multiport[name=Named, port="domain,953", protocol=tcp] # sendmail-whois[name=Named, dest=admin@mail] logpath = /var/log/named/security.log ignoreip = 168.192.0.0/16 172.16.0.0/12 10.0.0.0/8 publicsub/29

Notice that I use shorewall not iptables directly.

That gave me two things, One is reducing logwatch from 2-5MB to 360KB, and Second is blocking DDOS attacking IP's from repeating attacks for certain amount of time (few days I think).

Too bad fail2ban does not have global attacker database like denyhosts does. Global threat needs global defense.