Is this an attack? I get a lot of :
view external: query (cache) denied
in the /var/log/messages
Is this an attack? I get a lot of :
view external: query (cache) denied
in the /var/log/messages
No that's no hack ;) Obviously Your DNS server isn't set up well. Try adding
nameserver 127.0.0.1
to DNS server's /etc/resolv.conf
and add your subnet (192.168.0.0/24) to /etc/bind/named.conf
acl internals { 127.0.0.0/8; 192.168.0.0/24; };
It is probably not an attack. The only one thing that I'd suggest to better bind9 configuration is to set up logging so that such kind of security lines are written in their own file. For example, in the "logging" stanza:
channel security_log {
file "/var/log/named-denied.log" versions 3;
print-time yes;
print-severity yes;
print-category yes;
severity info;
};
and
category security { security_log; };
If bind is configured well, that file will be filled with queries that shouldn't have been directed to your server in the first place. It is possible to extract recurring patterns, for example expired delegations --even after several years.
It's not a hack however you need to set up your server's DNS better. If you use cpanel for your control panel WHM should automatically pick up the information. If not you can fix it later on when you set up your name servers, set an ip to them, etc.