New problem with lame-server after Dist-Upgrade

2011-12-24 Thread Michelle Konzack
Hello *, my Inttranet NameServer (my DNS-Master) was running Debian Lenny/5.0 and is now upgraded to Debian Squeeze/6.0 and et I get per day very huge named.log files, because: [ '/var/log/named.log' ] Dec 25 00:21:01 dns named[29004]:

Re: New problem with lame-server after Dist-Upgrade

2011-12-24 Thread Ben Croswell
Did the BIND version change with the OS upgrade? -Ben Croswell On Dec 24, 2011 6:38 PM, Michelle Konzack linux4miche...@tamay-dogan.net wrote: Hello *, my Inttranet NameServer (my DNS-Master) was running Debian Lenny/5.0 and is now upgraded to Debian Squeeze/6.0 and et I get per day very

How can someone know Sub-Domains?

2011-12-24 Thread Michelle Konzack
Hello *, I have installed inside my corporated domain a subdomain for a customer and now this subdomain is under attack, exactly, the Domains with 37 Courier-Servers and 140 Web-Servers are DoS'ed. This mean, someone is trying to bring down the whole network using 200k IPs. I use a

Re: New problem with lame-server after Dist-Upgrade

2011-12-24 Thread Michelle Konzack
Hello Ben Croswell, Am 2011-12-24 18:42:09, hacktest Du folgendes herunter: Did the BIND version change with the OS upgrade? Yes. I had this problem some years ago: 8-- Mark Andrews marka at isc.org Tue Aug 3 22:32:29 UTC

Re: How can someone know Sub-Domains?

2011-12-24 Thread Michelle Konzack
Forgotten one thing: The Sub-Domain has IPv6 addresses and the Serves are not hit by IP, but there FQDN, which mean, someone has gotten the list of the hostnames since I can not believe, the attacker has scanned my 4 IPv6 Networks to find out, where the servers are. (I do not use

Re: New problem with lame-server after Dist-Upgrade

2011-12-24 Thread Michelle Konzack
For soem seconds I have read a message (not from me) where someone asked, whether forwarders where configured and do not accept queries... So I have removed my forwarders and restarted bind9: --[ '/var/log/named.log' ]-- Dec 25 01:36:09 storage000

Re: How can someone know Sub-Domains?

2011-12-24 Thread Larry Brower
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 12/24/2011 05:48 PM, Michelle Konzack wrote: Hello *, I have installed inside my corporated domain a subdomain for a customer and now this subdomain is under attack, exactly, the Domains with 37 Courier-Servers and 140 Web-Servers are

Re: How can someone know Sub-Domains?

2011-12-24 Thread Michelle Konzack
Hello Larry Brower, Am 2011-12-24 19:54:05, hacktest Du folgendes herunter: Why would you give them a subdomain? Why does AKAMAI do suh things? ;-) How do you know they weren't being targeted prior to coming to you? I was admin of the servers for 12 years Why haven't you nulled them yet?