From owner-freebsd-questions Mon Feb 12 6:43: 5 2001 Delivered-To: freebsd-questions@freebsd.org Received: from hercules.rbmg.com (unknown [207.243.236.14]) by hub.freebsd.org (Postfix) with ESMTP id 70EC737B4EC for ; Mon, 12 Feb 2001 06:42:58 -0800 (PST) Received: by hercules.rbmg.com with Internet Mail Service (5.5.2653.19) id ; Mon, 12 Feb 2001 09:44:26 -0500 Message-ID: From: Scott Hyjek To: "'freebsd-questions@FreeBSD.ORG'" Subject: Question: bind / named problem Date: Mon, 12 Feb 2001 09:44:25 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C09502.4BBD1510" Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C09502.4BBD1510 Content-Type: text/plain; charset="iso-8859-1" Any information or guidance would be appreciated. We've experienced a problem on our external DNS twice now (last thursday and Sunday). Name resolution ceases and we receive the following: quentin/kernel: pid 104 (named), uid 0: exited on signal 6 (core dumped) This server has run fine for many many months and we've only recently (as above) encountered this problem. No hardware or software changes have occured. Lastly, we're aware of the current Bind vulnerability and plan to upgrade to eliminate it. However, we'd like some guidance (if any is available) as to how to determine if we've been exploited in such a manner. Thanks. Scott Hyjek "Little Man...Big Attitude" Network Engineering 803-741-3101 ------_=_NextPart_001_01C09502.4BBD1510 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Question: bind / named problem

Any information or guidance would be = appreciated. We've experienced a problem on our external DNS twice now = (last thursday and Sunday). Name resolution ceases and we receive the = following:

quentin/kernel: pid 104 (named), uid = 0: exited on signal 6 (core dumped)
This server has run fine for many = many months and we've only recently (as above) encountered this = problem. No hardware or software changes have occured.

Lastly, we're aware of the current = Bind vulnerability and plan to upgrade to eliminate it. However, we'd = like some guidance (if any is available) as to how to determine if = we've been exploited in such a manner. Thanks.

<scott>

Scott Hyjek
"Little Man...Big = Attitude"
Network Engineering
803-741-3101

------_=_NextPart_001_01C09502.4BBD1510-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message