Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am running my own DNS and I am logging all the DNS lookups. Today, I realized that there are over 200 entries for unwanted subdomain queries in the log.

Interestingly, these non-existent subdomains are possibly sensitive areas. Another issue is that these entries DO NOT exist in either access.log or error.log.

I am kinda worried that these are hack attempts.

I have 3 questions:

  1. How can I add these non-existent subdomain queries to error.log?
  2. Is there any Ubuntu package out there that can block this kind of hack attempt?
  3. What are my other options?

Sample DNS query log:

15-Dec-2011 01:12:41.726 queries: info: client 169.152.96.22#42014: query: adminarea.site.com IN A -ED (174.227.21.23)
share|improve this question

1 Answer 1

up vote 0 down vote accepted

When you talk of access.log and error.log, I assume you're talking about HTTP server logs.

To make an HTTP request, the process goes something like this (vastly simplified):

  1. the client issues a DNS request to map the host name from the URL to an IP address.
  2. the client makes a TCP connection to the web server at the given IP address.
  3. the server sends back the requested page.

If you aren't seeing any activity in the HTTP server logs, then it means that either (a) the first step failed with the DNS server returning a "no such domain" response, or (b) the client was looking up the host name for some other purpose (e.g. email, ftp, etc).

If you are running a public web site, you'll just have to deal with random people probing for host names in your domain. Provided you're not relying on obscure host names as a form of security, this shouldn't be a big concern.

share|improve this answer
    
I don't agree with you James. Of course, it's a security threat. In 1 min, if I see over 200 non-exist subdomain requests in my DNS log, should I go to Starbucks and drink my coffee and not worry about it? I like to block these IP's safely. Also, I am surprised that you assumed those access.log and error.log as HTTP logs. What else they can be? –  Nizzy Dec 15 '11 at 17:17
    
As an example, CUPS uses similar log file names. You weren't explicit in your question, so I thought I'd state my assumption up front in case you meant something else. I'm not saying that you shouldn't worry about security, but rather that DNS might not be the right place to put up your defences. Given that most hosts forward their DNS requests to another server rather than perform their own name resolution, the DNS logs won't necessarily tell you which host is going to make use of the information in the response. –  James Henstridge Dec 16 '11 at 5:47
    
Hi James, thanks for the answers. I was little bit nasty here. Sorry about that. Actually, after asking this question, my server was hacked and was down for 8 hours. Mysql is crashed and iptables db is locked. I recover the mysql, and I flushed the iptables. I am not sure how they did it, but it was from Ukraine. –  Nizzy Dec 16 '11 at 8:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.