Re: [SSHGuard-users] Adding support for bind/named

[Kevin Z. <kev...@gm...>]

Hi Nico,

On 7/27/21 11:53 PM, Nico Schottelius wrote:
> Jul 28 08:45:16 router1 named[135105]: client @0x7f13c4158c00 172.117.192.180#3074 (pizzaseo.com): query (cache) 'pizzaseo.com/RRSIG/IN' denied
> 
> every few seconds. The reason why this is an attack is that the servers
> are resolvers for the DC and authoritative for various domains - so
> internal recursive queries are allowed, external aren't.

This seems reasonable to me.

If you'd like to try to add this signature yourself and submit a patch, 
we have some brief instructions here:

https://bitbucket.org/sshguard/sshguard/src/master/CONTRIBUTING.rst#rst-header-add-new-signatures

Otherwise, I can help take a look at adding this signature in the next 
couple of days.

Regards,
Kevin