Re: BOPM Problem

Athenon <[email protected]> Mon, 27 Apr 2009 02:49:25 -0500
Newsgroups gmane.network.irc.bopm
Message-ID <[email protected]>
This is a multi-part message in MIME format.
--------------010004090103080300060107
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Just as suddenly as it came, the problem just vanished.  I haven't 
changed anything, and to my knowledge, the nameservers haven't changed 
anything.  Weird. :S

-Athenon

On 4/26/2009 6:31 AM, William Pitcock wrote:
> Are these nameservers running MaraDNS? That has problems with the
> DroneBL software, of which DroneBL and I believe SwiftBL are derived
> from.
>
> I don't know about efnet's setup, but it's a possibility that the
> zonefile is created in the same way.
>
> I think it's due to there being no $SOA for the dnsbl zone itself, but
> do not have time to debug it fully.
>
> (This is done intentionally to prevent caching of results on
> nameservers, in an attempt to reduce delays for unblacklisting to take
> effect.)
>
>   - nenolod
>
> On Sun, 2009-04-26 at 05:22 -0500, Athenon wrote:
>    
>> Here is my resolv.conf.  It looks normal to me.
>>
>> domain members.linode.com
>> search members.linode.com
>> nameserver 72.14.179.5
>> nameserver 72.14.188.5
>>
>> And...my iptables output.
>>
>> root@subaru:~# iptables -L -n
>> Chain INPUT (policy ACCEPT)
>> target     prot opt source               destination
>> fail2ban-ssh  tcp  --  0.0.0.0/0            0.0.0.0/0
>> multiport dports 22
>>
>> Chain FORWARD (policy ACCEPT)
>> target     prot opt source               destination
>>
>> Chain OUTPUT (policy ACCEPT)
>> target     prot opt source               destination
>>
>> Chain fail2ban-ssh (1 references)
>> target     prot opt source               destination
>> RETURN     all  --  0.0.0.0/0            0.0.0.0/0
>>
>>
>> On 4/26/2009 5:17 AM, Brett Cooper wrote:
>>      
>>> You are not the only one having this issue. It appears to be a
>>> resolv.conf or IPTables issue from what I can tell.
>>>
>>> 05:55:16)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 102.218.248.80.rbl.efnetrbl.org: Server failure
>>> 07:25:31)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 203.26.194.87.dnsbl.swiftbl.net: Server failure
>>> 07:25:38)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 229.83.233.4.dnsbl.dronebl.org: Server failure
>>> 07:25:38)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 229.83.233.4.dnsbl.swiftbl.net: Server failure
>>> 09:00:22)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 216.137.40.78.rbl.efnetrbl.org: Server failure
>>> 09:19:24)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 94.117.74.82.dnsbl.dronebl.org: Server failure
>>> 09:19:24)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 94.117.74.82.dnsbl.swiftbl.net: Server failure
>>> 09:44:09)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 229.16.209.217.dnsbl.dronebl.org: Server failure
>>> 10:09:19)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 52.141.25.85.rbl.efnetrbl.org: Server failure
>>> 10:26:58)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 27.241.61.87.rbl.efnetrbl.org: Server failure
>>> 10:47:21)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 203.26.194.87.rbl.efnetrbl.org: Server failure
>>> 11:01:49)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 203.26.194.87.dnsbl.dronebl.org: Server failure
>>> 11:01:49)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 203.26.194.87.rbl.efnetrbl.org: Server failure
>>> 11:40:17)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 203.26.194.87.dnsbl.dronebl.org: Server failure
>>> 11:40:17)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 203.26.194.87.rbl.efnetrbl.org: Server failure
>>> 11:40:17)<%ProxyCheck>  DNSBL ->  Lookup error on
>>> 203.26.194.87.dnsbl.swiftbl.net: Server failure
>>>
>>> My other two BOPM scanners are on different servers do not return this
>>> issue.
>>>
>>> --Brett
>>>
>>> Athenon wrote:
>>>        
>>>> I'm getting a Server Failure every time people connect to my server.
>>>> I've used the same stuff for months, maybe even years without any
>>>> problem.  I haven't changed anything, I just randomly started getting
>>>> all these server failures.  I've looked through FAQs and docs, and
>>>> the only thing I can find is something about not using
>>>> opm.blitzed.org, but as far as I know, I'm not using it anyway.
>>>> Here's an excerpt from my bopm.log.
>>>>
>>>> [Apr 26 07:50:50 2009] DNSBL ->  Lookup error on
>>>> 20.145.64.72.dnsbl.dronebl.org: Server failure
>>>> [Apr 26 07:58:15 2009] DNSBL ->  Lookup error on
>>>> 84.117.115.208.dnsbl.dronebl.org: Server failure
>>>> [Apr 26 08:09:20 2009] DNSBL ->  Lookup error on
>>>> 52.141.25.85.dnsbl.dronebl.org: Server failure
>>>> [Apr 26 08:20:50 2009] DNSBL ->  Lookup error on
>>>> 20.145.64.72.dnsbl.dronebl.org: Server failure
>>>> [Apr 26 08:50:50 2009] DNSBL ->  Lookup error on
>>>> 20.145.64.72.dnsbl.dronebl.org: Server failure
>>>> [Apr 26 08:51:30 2009] DNSBL ->  Lookup error on
>>>> 248.14.87.203.dnsbl.dronebl.org: Server failure
>>>> [Apr 26 09:00:15 2009] DNSBL ->  Lookup error on
>>>> 89.217.26.216.dnsbl.dronebl.org: Server failure
>>>> [Apr 26 09:09:20 2009] DNSBL ->  Lookup error on
>>>> 52.141.25.85.dnsbl.dronebl.org: Server failure
>>>> [Apr 26 09:20:50 2009] DNSBL ->  Lookup error on
>>>> 20.145.64.72.dnsbl.dronebl.org: Server failure
>>>> [Apr 26 09:42:40 2009] DNSBL ->  Lookup error on
>>>> 168.56.192.74.dnsbl.dronebl.org: Server failure
>>>>
>>>>
>>>>          
>
>    


--------------010004090103080300060107
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
  <meta content="text/html; charset=ISO-8859-1"
 http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Just as suddenly as it came, the problem just vanished.&nbsp; I haven't
changed anything, and to my knowledge, the nameservers haven't changed
anything.&nbsp; Weird. :S<br>
<br>
-Athenon<br>
<br>
On 4/26/2009 6:31 AM, William Pitcock wrote:
<blockquote cite="mid:1240745510.4387.10.camel@petrie" type="cite">
  <pre wrap="">Are these nameservers running MaraDNS? That has problems with the
DroneBL software, of which DroneBL and I believe SwiftBL are derived
from.

I don't know about efnet's setup, but it's a possibility that the
zonefile is created in the same way.

I think it's due to there being no $SOA for the dnsbl zone itself, but
do not have time to debug it fully.

(This is done intentionally to prevent caching of results on
nameservers, in an attempt to reduce delays for unblacklisting to take
effect.)

 - nenolod

On Sun, 2009-04-26 at 05:22 -0500, Athenon wrote:
  </pre>
  <blockquote type="cite">
    <pre wrap="">Here is my resolv.conf.  It looks normal to me.

domain members.linode.com
search members.linode.com
nameserver 72.14.179.5
nameserver 72.14.188.5

And...my iptables output.

root@subaru:~# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
fail2ban-ssh  tcp  --  0.0.0.0/0            0.0.0.0/0           
multiport dports 22

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain fail2ban-ssh (1 references)
target     prot opt source               destination
RETURN     all  --  0.0.0.0/0            0.0.0.0/0


On 4/26/2009 5:17 AM, Brett Cooper wrote:
    </pre>
    <blockquote type="cite">
      <pre wrap="">You are not the only one having this issue. It appears to be a 
resolv.conf or IPTables issue from what I can tell.

05:55:16) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
102.218.248.80.rbl.efnetrbl.org: Server failure
07:25:31) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
203.26.194.87.dnsbl.swiftbl.net: Server failure
07:25:38) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
229.83.233.4.dnsbl.dronebl.org: Server failure
07:25:38) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
229.83.233.4.dnsbl.swiftbl.net: Server failure
09:00:22) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
216.137.40.78.rbl.efnetrbl.org: Server failure
09:19:24) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
94.117.74.82.dnsbl.dronebl.org: Server failure
09:19:24) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
94.117.74.82.dnsbl.swiftbl.net: Server failure
09:44:09) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
229.16.209.217.dnsbl.dronebl.org: Server failure
10:09:19) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
52.141.25.85.rbl.efnetrbl.org: Server failure
10:26:58) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
27.241.61.87.rbl.efnetrbl.org: Server failure
10:47:21) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
203.26.194.87.rbl.efnetrbl.org: Server failure
11:01:49) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
203.26.194.87.dnsbl.dronebl.org: Server failure
11:01:49) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
203.26.194.87.rbl.efnetrbl.org: Server failure
11:40:17) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
203.26.194.87.dnsbl.dronebl.org: Server failure
11:40:17) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
203.26.194.87.rbl.efnetrbl.org: Server failure
11:40:17) &lt;%ProxyCheck&gt; DNSBL -&gt; Lookup error on 
203.26.194.87.dnsbl.swiftbl.net: Server failure

My other two BOPM scanners are on different servers do not return this 
issue.

--Brett

Athenon wrote:
      </pre>
      <blockquote type="cite">
        <pre wrap="">I'm getting a Server Failure every time people connect to my server.  
I've used the same stuff for months, maybe even years without any 
problem.  I haven't changed anything, I just randomly started getting 
all these server failures.  I've looked through FAQs and docs, and 
the only thing I can find is something about not using 
opm.blitzed.org, but as far as I know, I'm not using it anyway.  
Here's an excerpt from my bopm.log.

[Apr 26 07:50:50 2009] DNSBL -&gt; Lookup error on 
20.145.64.72.dnsbl.dronebl.org: Server failure
[Apr 26 07:58:15 2009] DNSBL -&gt; Lookup error on 
84.117.115.208.dnsbl.dronebl.org: Server failure
[Apr 26 08:09:20 2009] DNSBL -&gt; Lookup error on 
52.141.25.85.dnsbl.dronebl.org: Server failure
[Apr 26 08:20:50 2009] DNSBL -&gt; Lookup error on 
20.145.64.72.dnsbl.dronebl.org: Server failure
[Apr 26 08:50:50 2009] DNSBL -&gt; Lookup error on 
20.145.64.72.dnsbl.dronebl.org: Server failure
[Apr 26 08:51:30 2009] DNSBL -&gt; Lookup error on 
248.14.87.203.dnsbl.dronebl.org: Server failure
[Apr 26 09:00:15 2009] DNSBL -&gt; Lookup error on 
89.217.26.216.dnsbl.dronebl.org: Server failure
[Apr 26 09:09:20 2009] DNSBL -&gt; Lookup error on 
52.141.25.85.dnsbl.dronebl.org: Server failure
[Apr 26 09:20:50 2009] DNSBL -&gt; Lookup error on 
20.145.64.72.dnsbl.dronebl.org: Server failure
[Apr 26 09:42:40 2009] DNSBL -&gt; Lookup error on 
168.56.192.74.dnsbl.dronebl.org: Server failure


        </pre>
      </blockquote>
    </blockquote>
  </blockquote>
  <pre wrap=""><!---->
  </pre>
</blockquote>
<br>
</body>
</html>

--------------010004090103080300060107--