Jan 5 08:05:08 ns named[800]: lame server resolving '65.94.174.211.in-addr.arpa' (in '94.174.211.in-addr.arpa'?): 21
1.41.4.33#53 Jan 5 08:05:08 ns named[800]: lame server resolving '65.94.174.211.in-addr.arpa' (in '94.174.211.in-addr.
arpa'?): 211.41.4.34#53 Jan 5 08:05:08 ns named[800]: lame server resolving '65.94.174.211.in-addr.arpa' (in '94.174.2
11.in-addr.arpa'?): 211.41.4.33#53 Jan 5 08:05:08 ns named[800]: lame server resolving '65.94.174.211.in-addr.arpa' (i
n '94.174.211.in-addr.arpa'?): 211.41.4.34#53 Jan 5 08:05:08 ns named[800]: lame server resolving '65.94.174.211.in-ad
dr.arpa' (in '94.174.211.in-addr.arpa'?): 211.41.4.33#53 Jan 5 08:05:08 ns named[800]: lame server resolving '65.94.17
4.211.in-addr.arpa' (in '94.174.211.in-addr.arpa'?): 211.41.4.34#53 Jan 5 08:05:08 ns named[800]: lame server resolvin
g '65.94.174.211.in-addr.arpa' (in '94.174.211.in-addr.arpa'?): 211.41.4.33#53 Jan 5 08:05:08 ns named[800]: lame serv
er resolving '65.94.174.211.in-addr.arpa' (in '94.174.211.in-addr.arpa'?): 211.41.4.34#53 Jan 5 09:13:58 ns ftpd[15698
]: wu-ftpd - TLS settings: control allow, client_cert allow, data allow Jan 5 09:13:58 ns named[799]: lame server reso
lving '61.53.174.211.in-addr.arpa' (in '53.174.211.in-addr.arpa'?): 203.248.250.24#53 Jan 5 09:13:58 ns named[799]: la
me server resolving '61.53.174.211.in-addr.arpa' (in '53.174.211.in-addr.arpa'?): 203.248.250.25#53 Jan 5 09:13:58 ns
named[800]: lame server resolving '61.53.174.211.in-addr.arpa' (in '53.174.211.in-addr.arpa'?): 203.248.250.24#53 Jan
5 09:13:58 ns named[800]: lame server resolving '61.53.174.211.in-addr.arpa' (in '53.174.211.in-addr.arpa'?): 203.248.25
0.25#53 Jan 5 09:13:58 ns named[800]: lame server resolving '61.53.174.211.in-addr.arpa' (in '53.174.211.in-addr.arpa'
?): 203.248.250.24#53 Jan 5 09:13:58 ns named[800]: lame server resolving '61.53.174.211.in-addr.arpa' (in '53.174.211
.in-addr.arpa'?): 203.248.250.25#53 Jan 5 09:13:58 ns named[800]: lame server resolving '61.53.174.211.in-addr.arpa' (
in '53.174.211.in-addr.arpa'?): 203.248.250.24#53 Jan 5 09:13:58 ns named[800]: lame server resolving '61.53.174.211.i
n-addr.arpa' (in '53.174.211.in-addr.arpa'?): 203.248.250.25#53 Jan 5 09:13:58 ns named[800]: lame server resolving '6
1.53.174.211.in-addr.arpa' (in '53.174.211.in-addr.arpa'?): 203.248.250.24#53 Jan 5 09:13:58 ns named[800]: lame serve
r resolving '61.53.174.211.in-addr.arpa' (in '53.174.211.in-addr.arpa'?): 203.248.250.25#53 Jan 5 09:13:58 ns named[80
0]: lame server resolving '61.53.174.211.in-addr.arpa' (in '53.174.211.in-addr.arpa'?): 203.248.250.24#53 Jan 5 09:13:
58 ns named[800]: lame server resolving '61.53.174.211.in-addr.arpa' (in '53.174.211.in-addr.arpa'?): 203.248.250.25#53-
-젠장..아는게 없더....
lame server 로그는 역방향 DNS 를 조회한 상대 서버가 제대로 된 응답을 주지 못했다는 뜻이라 공격이라고 단정하기 어렵습니다. 로그에 나온 IP 가 역방향 존의 위임 서버일 가능성이 큽니다.
로컬 네임서버의 동작에는 큰 문제가 없으니, 같은 로그가 계속 많으면 해당 역방향 존의 위임 상태를 확인하세요.