# Denied zone transfer not detected by periodic



## johnblue (Oct 15, 2013)

I notice in /var/log/messages that there were some zone transfer attempts:

```
Oct 12 08:39:52  named[1027]: client 91.222.136.77#33551: zone transfer 'p.com/AXFR/IN' denied
Oct 12 12:02:53  named[1027]: client 91.222.136.14#36152: zone transfer 'y.com/AXFR/IN' denied
Oct 12 13:02:06  named[1027]: client 91.222.136.14#39311: zone transfer 'c.com/AXFR/IN' denied
Oct 13 10:49:46  named[1027]: client 89.209.83.238#56423: zone transfer 'g.com/AXFR/IN' denied
Oct 13 14:42:25  named[1027]: client 89.209.83.238#54068: zone transfer 's.com/AXFR/IN' denied
Oct 13 20:14:38  named[1027]: client 91.222.136.77#55465: zone transfer 's.com/AXFR/IN' denied
Oct 13 23:52:30  named[1027]: client 91.222.136.77#56195: zone transfer 'e.com/AXFR/IN' denied
```

Oddly enough, periodic completely missed them:
	
	



```
Local system status:
 3:01AM  up 30 days,  4:55, 1 user, load averages: 0.00, 0.00, 0.00

Mail in local queue:
/var/spool/mqueue is empty
		Total requests: 0

Mail in submit queue:
/var/spool/clientmqueue is empty
		Total requests: 0

Security check:
    (output mailed separately)

Checking for rejected mail hosts:

Checking for denied zone transfers (AXFR and IXFR):

-- End of daily output --
```

If anyone has some thoughts on were to look, that would be helpful meanwhile .. back to google.



Thanks.

-- as an aside I thought, "awww.  How cute, someone is trying to get a zone."


----------



## SirDice (Oct 15, 2013)

Looking at the script /etc/periodic/daily/470.status-named it seems it's looking for a different string. Are you using the base version of named or from ports? Different versions may report things a little different.


----------



## johnblue (Oct 15, 2013)

SirDice said:
			
		

> Are you using the base version of named or from ports?


Base version.  This particular box is at 9.1-RELEASE-p7.

What did you see that stood out?  This line seems to be kind of a catch all:  
	
	



```
fgrep -E "^$start.*named\[[[:digit:]]+\]: transfer of .*failed .*: REFUSED" |
```


----------



## SirDice (Oct 15, 2013)

There's no string in your logs that says "transfer of .... failed", yours says "zone transfer .... denied".


----------

