Re: [cobalt-users] Security violations

[Nico Meijer <nico.meijer@xxxxxxxxx>]

Hi Robbert,

> Nov 12 08:25:13 www named[592]: denied update from [195.121.232.7].3619 for
> "XXXXXXXXXXX.nl"


Welcome to the Club of Wintendo 2000 Non-Likers (TM). You get no t-shirt 
with your subscription.

> How do I block this one so that I don't get this errror any more and so that
> this IP can't use it anymore connecting to named.
>
> The IP is a DIALUP ip ! So I donot need that named transfer !


If it's dialup, forget it, *or* block the entire group of IPs from 
accessing your '53rd':
http://www.ripe.net/perl/whois?query=195.121.232.7&.submit=

You could contact this ISP and tell them to educate their clients, but 
I've had little luck with this particular ISP to get anything through 
the thick minds of their staff... Plated steel surrounds the call 
center, I guess.

> Suggestions are more than welcome !

Block the message through logcheck. I added "named.*denied update from" 
to ignore and violations.ignore and the trouble went away.

10 to 1 says it's one of your customers. Show 'em this:
http://www.domainregistry.ie/tech/dynamic-dns.html

HTH... Nico