1

I recently replaced my CentOS 5 authoritative BIND servers with CentOS 7. Everything is working fine, but my logs show some weirdness. I use a hidden master and my primary and secondary name servers are slaves of the hidden master.

My primary name server has a large number of entries like this in the named.run log file:

08-Apr-2017 08:39:05.785 update-security: error: client 117.239.55.98#50131: update forwarding 'ABC.COM/IN' denied
08-Apr-2017 08:39:08.500 update-security: error: client 166.171.122.223#38067: update forwarding 'XXY.org/IN' denied
08-Apr-2017 08:39:20.855 update-security: error: client 69.43.159.190#51671: update forwarding 'yyz.com/IN' denied
08-Apr-2017 08:40:01.163 update-security: error: client 117.239.55.98#54976: update forwarding 'ABC.COM/IN' denied
08-Apr-2017 08:40:06.379 update-security: error: client 117.239.55.98#65535: update forwarding 'ABC.COM/IN' denied
08-Apr-2017 08:40:23.952 update-security: error: client 117.239.55.98#59592: update forwarding 'ABC.COM/IN' denied

I'm pretty sure this is benign and expected behavior because:

  1. my SOA records list my primary name server (not the hidden master). So that explains why ns1 logs all these errors while ns2 never logs errors like this.
  2. I don't allow nor want to allow client updates and named.conf is configured as such.

Which leads to my questions:

  1. Is it indeed safe to ignore these errors?
  2. If so, is there a way to configure my named logging to suppress these errors but still log any other legitimate errors? The relevant portion of named.conf looks like this:
logging {
        channel default_debug {
                file "data/named.run" versions 3 size 5m;
                severity notice;        
                print-time yes;
                print-severity yes;
                print-category yes;
        }; };

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.