BIND query denied not blocking

This forum is only for reproducible bugs with csf and lfd (i.e. not iptables problems, lack of understanding how to use a feature, etc). Posts must be accompanied with full technical details of the problem and how it can be recreated. Any posts not adhering to this, or not considered bugs, will be moved to the General Discussion (csf) forum.
Post Reply
grh2g46
Junior Member
Posts: 1
Joined: 01 Jul 2014, 19:01

BIND query denied not blocking

Post by grh2g46 »

I have

LF_BIND = "2" (for testing purposes)
BIND_LOG = "/var/log/syslog"

but its not picking up any of the denied querys im seeing.


Seeing the following in /var/log/syslog

Code: Select all

Jul  1 18:18:45 serval named[4556]: client 202.46.56.112#1814: query (cache) '*************/A/IN' denied
Jul  1 18:18:45 serval named[4556]: client 180.76.5.190#37682: query (cache) '*************/A/IN' denied
Jul  1 18:18:45 serval named[4556]: client 180.76.6.135#43435: query (cache) '*************/A/IN' denied
Jul  1 18:18:45 serval named[4556]: client 180.76.5.94#33739: query (cache) '*************/A/IN' denied
Jul  1 18:19:09 serval named[4556]: client 65.55.5.152#33841: query (cache) '*************/A/IN' denied
Jul  1 18:19:09 serval named[4556]: client 65.55.5.152#33841: query (cache) '*************/A/IN' denied
Jul  1 18:19:09 serval named[4556]: client 65.55.5.152#33841: query (cache) '*************/A/IN' denied
Jul  1 18:19:27 serval named[4556]: client 66.249.66.235#61879: query (cache) '*************/A/IN' denied
Jul  1 18:19:41 serval named[4556]: client 180.76.5.177#34078: query (cache) '*************/A/IN' denied
Jul  1 18:19:42 serval named[4556]: client 180.76.5.149#43122: query (cache) '*************/A/IN' denied
which as far as i can tell should match the default BIND regex
/^(\S+|\S+\s+\d+\s+\S+) \S+ named\[\d+\]: client (\S+)\#\d+\:( view external\:)? (update|zone transfer|query \(cache\)) \'.*\' denied$/

Any ideas what im missing?
ForumAdmin
Moderator
Posts: 1524
Joined: 01 Oct 2008, 09:24

Re: BIND query denied not blocking

Post by ForumAdmin »

Thank you for reporting this. The problem will be fixed in the next release which will be soon.
Post Reply