Re: strange DNS query
Hans Mayer via mod-security-users <[email protected]> Sat, 2 Nov 2024 18:28:11 +0100
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============7092385882738001075== Content-Type: multipart/alternative; boundary="------------nAUDizLDK3zlEFiK0xsWStEo" Content-Language: de-DE, en-GB This is a multi-part message in MIME format. --------------nAUDizLDK3zlEFiK0xsWStEo Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Hi Robert, Hi Ervin, many thanks for your information. I don't have any issues with statistics. But as it is not used any more I switched off as recommended. Kind regards Hans -- On 02.11.24 10:29, Ervin Hegedüs wrote: > Hi Hans, > > as Robert explained, this is because ModSecurity has a feature (see > the blogpost). > > Please note that there is an intention that we would like to stop > using this variable. It's been set to "Off" for a while, see > https://github.com/owasp-modsecurity/ModSecurity/issues/3085. > > You need to update this in your config file (especially since > TrustWave transferred the project to OWASP these DNS queries don't > work at all). > > > > Thanks, > > > a. > > > On Fri, Nov 1, 2024 at 9:37 PM Hans Mayer via mod-security-users > <[email protected]> wrote: > > > Dear All, > > I am using Apache/2.4.62 on Debian with the modsecurity-crs package > which is Producer ModSecurity for Apache/2.9.7 and Rule Set > OWASP_CRS/4.9.0-dev > > Each time I restart Apache I find a strange log entry in BINDs > query log. > The system is looking for a name > GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WEY5LBEA2S4MJM.GIXDSLRRGQWGGMY.1730491019.status.modsecurity.org > <http://GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WEY5LBEA2S4MJM.GIXDSLRRGQWGGMY.1730491019.status.modsecurity.org> > as A resource record which does not exists. > The query is almost the same except the number ( 1730491019 ) wich is > the Unix time. > Also this string GIXDSLRRGQWGGMY is different on different servers. > > Any idea for what this should be useful ? Does it make sense ? > Which part is actually doing this ? > > Kind regards > Hans > > -- > > > > _______________________________________________ > mod-security-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ > --------------nAUDizLDK3zlEFiK0xsWStEo Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body> <p><br> </p> <p>Hi Robert, Hi Ervin, <br> </p> <p>many thanks for your information. <br> I don't have any issues with statistics. But as it is not used any more I switched off as recommended. <br> </p> <p>Kind regards <br> Hans <br> </p> <p>-- <br> </p> <p><br> </p> <div class="moz-cite-prefix">On 02.11.24 10:29, Ervin Hegedüs wrote:<br> </div> <blockquote type="cite" cite="mid:CAJ2uXbdRH1u+LTYtr3g7f=SOLiC1M=DvwcEvjtNo3144+2iQYA@mail.gmail.com"> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> <div dir="ltr"> <div>Hi Hans,</div> <div><br> </div> <div>as Robert explained, this is because ModSecurity has a feature (see the blogpost).</div> <div><br> </div> <div>Please note that there is an intention that we would like to stop using this variable. It's been set to "Off" for a while, see <a href="https://github.com/owasp-modsecurity/ModSecurity/issues/3085" moz-do-not-send="true" class="moz-txt-link-freetext">https://github.com/owasp-modsecurity/ModSecurity/issues/3085</a>.</div> <div><br> </div> <div>You need to update this in your config file (especially since TrustWave transferred the project to OWASP these DNS queries don't work at all).</div> <div><br> </div> <div><br> </div> <div><br> </div> <div>Thanks,</div> <div><br> </div> <div><br> </div> <div>a.</div> <div><br> </div> </div> <br> <div class="gmail_quote"> <div dir="ltr" class="gmail_attr">On Fri, Nov 1, 2024 at 9:37 PM Hans Mayer via mod-security-users <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>> wrote:<br> </div> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br> Dear All,<br> <br> I am using Apache/2.4.62 on Debian with the modsecurity-crs package <br> which is Producer ModSecurity for Apache/2.9.7 and Rule Set <br> OWASP_CRS/4.9.0-dev<br> <br> Each time I restart Apache I find a strange log entry in BINDs query log.<br> The system is looking for a name<br> <a href="http://GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WEY5LBEA2S4MJM.GIXDSLRRGQWGGMY.1730491019.status.modsecurity.org" rel="noreferrer" target="_blank" moz-do-not-send="true">GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WEY5LBEA2S4MJM.GIXDSLRRGQWGGMY.1730491019.status.modsecurity.org</a><br> as A resource record which does not exists.<br> The query is almost the same except the number ( 1730491019 ) wich is <br> the Unix time.<br> Also this string GIXDSLRRGQWGGMY is different on different servers.<br> <br> Any idea for what this should be useful ? Does it make sense ?<br> Which part is actually doing this ?<br> <br> Kind regards<br> Hans<br> <br> -- <br> <br> <br> <br> _______________________________________________<br> mod-security-users mailing list<br> <a href="mailto:[email protected]" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a><br> <a href="https://lists.sourceforge.net/lists/listinfo/mod-security-users" rel="noreferrer" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://lists.sourceforge.net/lists/listinfo/mod-security-users</a><br> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:<br> <a href="http://www.modsecurity.org/projects/commercial/rules/" rel="noreferrer" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">http://www.modsecurity.org/projects/commercial/rules/</a><br> <a href="http://www.modsecurity.org/projects/commercial/support/" rel="noreferrer" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">http://www.modsecurity.org/projects/commercial/support/</a><br> </blockquote> </div> </blockquote> </body> </html> --------------nAUDizLDK3zlEFiK0xsWStEo-- --===============7092385882738001075== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============7092385882738001075== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ mod-security-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/ --===============7092385882738001075==--