Re: [cobalt-security] named "denied update" error

[Glen Scott <glen@xxxxxxxxxxxxxxxxxxxx>]

At 18:10 04/05/01, you wrote:
> >Hello Cobalt Security Gurus --
> >
> >I'm getting this error message in my log
> >several hundred times a day:
> >
> >May 3 19:31:17 www named[671]: denied update from [157.238.135.154].9594
> for >"KELLER.COM"
> >
> >Of course the timestamp changes, and so does the PID
> >(I assume that 9594 is a PID) but the rest of the message
> >is the same...  dozens every hour.
> >
> >KELLER.COM is my domain and I run the primary
> >name server for it.
>
> I had the same problem.  I was getting the same errors from a domain that
> belonged to one of my customers.  After investigating for several weeks I
> determined that my customer had gotten a DSL connection and on that
> connection they had a Windows 2k Advanced Server installed.  And guess
> what...they named the computer their domain name.
>
> Apparently like it or not Win 2k goes out every so often and tries to update
> DNS records and will give errors to the actual domain.
>
> I'm not sure if this is the case, but may give you another avenue to
> explore...

This is exactly right.  I have had the same problem for the past couple of 
weeks, and it stems from a Windows 2000 server trying to update your DNS 
records.  You will have to contact the owner of the IP address and ask them 
to change their network name to something different- preferably something 
unique.

-Glen


-----------------------------------------------------
  Design Solution Limited
  t: +44 (0)1502 513008
  f: +44 (0)1502 588622
  e: info@xxxxxxxxxxxxxxxxxxxx
  w: http://www.designsolution.co.uk
  Nouvotech House, Harbour Road,
  Oulton Broad, Suffolk, NR32 3LZ, UK
-----------------------------------------------------
Graphic Design - Web development - Hosting
-----------------------------------------------------