Did you change your dns servers of keller.com?
It looks like a nameserver thats configured as a master nameserver for
keller.com, and is telling your server that there were changes made in the
zone file.
So if it was configured right, your ns would transfer the domain from
157.238.135.154.
Looks like 157.238.135.154 has your zone in his dns, and looks like your
box is configured as ns2 in that zone file.
At 09:24 4-5-2001 -0700, you wrote:
>Hello Cobalt Security Gurus --
>
>I'm getting this error message in my log
>several hundred times a day:
>
>May 3 19:31:17 www named[671]: denied update from [157.238.135.154].9594
>for "KELLER.COM"
>
>Of course the timestamp changes, and so does the PID
>(I assume that 9594 is a PID) but the rest of the message
>is the same... dozens every hour.
>
>KELLER.COM is my domain and I run the primary
>name server for it.
>
>I'm guessing that an attempt to do a DNS zone transfer
>is failing... but that's just a guess.
>
>I can't find who owns 157.238.135.154 -- nslookup and dig
>yield nothing.
>
>Is it my named that's trying to reach 157.238.135.154 or is
>it 157.238.135.154's named that's trying to reach mine?
>
>Can anyone help me decipher this message?
>
>And once I know what the problem is, what do I do about it?
>
>Thank you in advance!
>
>Dan Keller
>[EMAIL PROTECTED]
>http://www.keller.com/
_______________________________________________
cobalt-security mailing list
[EMAIL PROTECTED]
http://list.cobalt.com/mailman/listinfo/cobalt-security
