Re: [cobalt-users] "unapproved update from [212.161.41.140]" error

[Jeff Bilicki <jeff@xxxxxxxxxxx>]

> i've received this error a bazillion times over the last weeks:
> # tail /var/log/messages
> Feb  6 22:04:39 www named[356]: unapproved update from [212.161.41.140].8200
> for domain.com
> Feb  6 22:09:31 www named[356]: unapproved update from [212.161.41.140].8226
> for domain.com
> Feb  6 22:09:32 www named[356]: unapproved update from [212.161.41.140].8227
> for domain.com
> some research indicates that it might be a windows 2000 machine,
> apparently if someone names their machine the same name as your
> domain, w2k attempts to update your domain's nameserver??
> anyway, i tried to bar access using hosts.deny but it fails to
> make a difference.

This is coming from your DNS server.  Are you acting as a secondary DNS for any
domains?  Adding those entries into /etc/hosts.deny will not affect this
request. 

Try turning debugging for named, as root:
$ ndc
ndc> querylog
# if you want _really_ verbose type:
ndc> trace 1
ndc> Ctrl-C 
$ tail -f /var/log/message

Wait for it to happen again.