The es-bind-errors module was developed by Extra Systems to protect the bind name server from hacker activity within the fail2ban system. Its purpose is to detect suspicious activity in the /var/log/named/security.log file.
To connect es-bind-errors to fail2ban, use the following configuration:
[es-bind-errors] enabled = true filter = es-bind-errors logpath = /var/log/named/security.log action = iptables-allports[name=es-bind-errors, blocktype=DROP, protocol=all]
Please note that this filter blocks all protocols on all ports for the identified hacker, using the DROP method. This turns your host into a complete "black hole" for this particular attacker. They will not receive any response to any subsequent IP packets. This approach significantly reduces the load on your server's resources.
The code for our es-bind-errors filter looks like this:
[Definition]
failregex = ^.* query-errors: info: client @0x\S+ <HOST>#\d+ \(.*\): query failed \(REFUSED\)
^.* security: error: client @0x\S+ <HOST>#\d+ \(.*\): zone transfer '.*' denied
ignoreregex =
This filter detects and prevents illegal attempts to read the entire zone (via AXFR queries), as well as unauthorized use of your name server as a resolver by third-party hosts. For it to work properly, your bind name server configuration must contain the following fragment:
logging {
channel security_file {
file "/var/log/named/security.log" versions 3 size 30m;
severity info;
print-time yes;
print-category yes;
print-severity yes;
};
category security { security_file; };
category query-errors { security_file; };
category queries { null; };
};
In practical use on our Linux servers, this filter has proven to be very effective in suppressing hacker activity within the bind name server.
The content of this page is also available in Russian.
| © Extra Systems, 2026 |
|