Bind9 Security Log not writing
https://askubuntu.com/questions/1566879/bind9-security-log-not-writingI have Bind9 version 9.18.39 on Ubuntu 24.04 LTS. The Bind is constantly being attacked for denial of service. I was managing it with Fail2ban jail for "refused+denied".
To decrease the rate limit, I implemented two views, internal and external, with a tight rate limit of responses-per-second=2 in window=15. As soon as I switched to two views, the "security log" stopped writing. But I still can see refused/denied messages in the "default-log".
I do not understand why the security log stopped writing. It was writing when I didn't have any views, and hence the permissions are correct. The default-log does not match the Fail2ban filter, and hence I need to get the Security-log to write again.
Any help will be appreciated.
My Views configuration
// Internal view for local clients (no rate limiting)
view "internal" {
match-clients { "internal-network"; };
recursion yes;
// Include your internal zones and settings here
// Consider adding the 1918 zones here, if they are not used in your organization
include "/etc/bind/zones.rfc1918";
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/named-master-zones-reverse-zones-internal";
include "/etc/bind/named-master-zones-forward-zones-internal";
include "/etc/bind/named-master-zones-forward-zones-certbot-modifiable-zones";
};
// External view for the rest of the world (with rate limiting)
view "external" {
# Allow anyone to query authoritative zones
match-clients { any; };
//allow-query { any; };
recursion no; // Usually desired for external-facing authoritative servers
// Apply Response Rate Limiting (RRL) specifically to this view
rate-limit { responses-per-second 2; // Sets the number of responses allowed per second per unique query/client pair (default: 0, which is disabled; common suggestion: 5-10)
window 15; // Time in seconds (1 to 3600) for tracking rates; default is 15
slip 0; // : Controls how many dropped responses are sent as truncated (TC=1) packets. Default is 2 (every other query); 0 disables it, 1 sends all dropped packets as truncated.
log-only no; // Set to 'no' to actually drop/reject
errors-per-second 1; // Limit error responses too
ipv4-prefix-length 32; // Track per-IPv4 address
};
// Consider adding the 1918 zones here, if they are not used in your organization
include "/etc/bind/zones.rfc1918";
include "/etc/bind/named.conf.default-zones";
// Include your public zones here
include "/etc/bind/named-master-zones-reverse-zones-external";
include "/etc/bind/named-master-zones-forward-zones-external";
};
My log configuration:
logging {
channel default_file {
file "/var/log/named/default.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel general_file {
file "/var/log/named/general.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel database_file {
file "/var/log/named/database.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel security_file {
file "/var/log/named/security.log" versions 3 size 5m;
severity info;
print-time yes;
print-severity yes;
print-category yes;
};
channel config_file {
file "/var/log/named/config.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel resolver_file {
file "/var/log/named/resolver.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel xfer-in_file {
file "/var/log/named/xfer-in.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel xfer-out_file {
file "/var/log/named/xfer-out.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel notify_file {
file "/var/log/named/notify.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel client_file {
file "/var/log/named/client.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel unmatched_file {
file "/var/log/named/unmatched.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel queries_file {
file "/var/log/named/queries.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel network_file {
file "/var/log/named/network.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel update_file {
file "/var/log/named/update.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel dispatch_file {
file "/var/log/named/dispatch.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel dnssec_file {
file "/var/log/named/dnssec.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
channel lame-servers_file {
file "/var/log/named/lame-servers.log" versions 3 size 5m;
severity dynamic;
print-time yes;
};
category default { default_file; };
category general { general_file; };
category database { database_file; };
category security { security_file; };
category config { config_file; };
category resolver { resolver_file; };
category xfer-in { xfer-in_file; };
category xfer-out { xfer-out_file; };
category notify { notify_file; };
category client { client_file; };
category unmatched { unmatched_file; };
category queries { queries_file; };
category network { network_file; };
category update { update_file; };
category dispatch { dispatch_file; };
category dnssec { dnssec_file; };
category lame-servers { lame-servers_file; };
};
My Options.conf
include "/etc/bind/named-acl.conf";
include "/etc/bind/rndc.key";
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};
options
{
//check-names master ignore;
listen-on port 53 { 127.0.0.1; any; };
listen-on-v6 port 53 { ::1; };
directory "/var/cache/bind";
# Restrict cache access to local trusted clients only
allow-query-cache { "localhost"; "mydomain-computers"; };
allow-transfer { "trusted-transfer-servers-mydomain.com"; "trusted-transfer-servers-xname.org"; "trusted-transfer-servers-buddydns.com"; };
notify primary-only;
key-directory "/var/cache/bind";
# Security best practices from ISC.org
dnssec-validation auto;
listen-on-v6 { any; };
};
