Named and the mysterious .so resolves

[James Lay <jlay () slave-tothe-box net>]

Hey all!

Soo...I see these in my logs from time to time:

Apr 10 14:46:37 mail named[739]: unexpected RCODE (REFUSED) resolving
'pam_mysql.so/NS/IN': 209.68.0.85#53

Can anyone shed any light on this?  Thanks all!  Below is a complete
list of .so's attempted:

'1.so/NS/IN':
'18.so/NS/IN':
'2.so/NS/IN':
'3.so/NS/IN':
'4.so/NS/IN':
'5.so/NS/IN':
'90.so/NS/IN':
'afsacl.so/NS/IN':
'chan_skinny.so/NS/IN':
'clearly.so/NS/IN':
'const_plugin_extension.so/NS/IN':
'db_file.so/NS/IN':
'declared.so/NS/IN':
'dict_ldap.so/NS/IN':
'dict_pgsql.so/NS/IN':
'died.so/NS/IN':
'dns.so/NS/IN':
'done.so/NS/IN':
'effort.so/NS/IN':
'encoplin.so/NS/IN':
'everyone.so/NS/IN':
'explode.so/NS/IN':
'face.so/NS/IN':
'fire.so/NS/IN':
'flaw.so/NS/IN':
'foo.so/NS/IN':
'frightful.so/NS/IN':
'gdome.so/NS/IN':
'guys.so/NS/IN':
'i.so/NS/IN':
'installed.so/NS/IN':
'ld.so/NS/IN':
'letters.so/NS/IN':
'lib.so/NS/IN':
'lib_sql.so/NS/IN':
'libanonymous.so/NS/IN':
'libc.so/NS/IN':
'libcap.so/NS/IN':
'libcrammd5.so/NS/IN':
'libcrypto.so/NS/IN':
'libcurl.so/NS/IN':
'libcxx.so/NS/IN':
'libdb.so/NS/IN':
'libdigestmd5.so/NS/IN':
'libdnet_stub.so/NS/IN':
'libdthelp.so/NS/IN':
'libdtsvc.so/NS/IN':
'libdtwidget.so/NS/IN':
'libdynamicexample.so/NS/IN':
'libdynamicexamplerule.so/NS/IN':
'libexc.so/NS/IN':
'libfontconfig.so/NS/IN':
'libfreetype.so/NS/IN':
'libgcrypt.so/NS/IN':
'libgd.so/NS/IN':
'libgdbm.so/NS/IN':
'libgdome.so/NS/IN':
'libglib.so/NS/IN':
'libgmp.so/NS/IN':
'libgnutls.so/NS/IN':
'libgpg-error.so/NS/IN':
'libgpgme.so/NS/IN':
'libgssapiv2.so/NS/IN':
'libice.so/NS/IN':
'libicmpplugin.so/NS/IN':
'libiconv.so/NS/IN':
'libipt_masquerade.so/NS/IN':
'libjpeg.so/NS/IN':
'libkmailprivate.so/NS/IN':
'libldapdb.so/NS/IN':
'liblogin.so/NS/IN':
'libltdl.so/NS/IN':
'libm.so/NS/IN':
'libmyrrd.so/NS/IN':
'libmysqlclient.so/NS/IN':
'libnss3.so/NS/IN':
'libntlm.so/NS/IN':
'libntop.so/NS/IN':
'libntopreport.so/NS/IN':
'libotp.so/NS/IN':
'libpcap-nessus.so/NS/IN':
'libpcap.so/NS/IN':
'libperl.so/NS/IN':
'libphp4.so/NS/IN':
'libphtread.so/NS/IN':
'libplain.so/NS/IN':
'libpng.so/NS/IN':
'libpthread.so/NS/IN':
'libresolv.so/NS/IN':
'librrd.so/NS/IN':
'librrd_th.so/NS/IN':
'libsasl2.so/NS/IN':
'libsasldb.so/NS/IN':
'libsf_dcerpc_preproc.so/NS/IN':
'libsf_dns_preproc.so/NS/IN':
'libsf_engine.so/NS/IN':
'libsf_ftptelnet_preproc.so/NS/IN':
'libsf_smtp_preproc.so/NS/IN':
'libsf_ssh_preproc.so/NS/IN':
'libsldap.so/NS/IN':
'libsm.so/NS/IN':
'libsql.so/NS/IN':
'libssl.so/NS/IN':
'libtasn1.so/NS/IN':
'libtiff.so/NS/IN':
'libtt.so/NS/IN':
'libvsapi.so/NS/IN':
'libx11.so/NS/IN':
'libxext.so/NS/IN':
'libxm.so/NS/IN':
'libxml2.so/NS/IN':
'libxmu.so/NS/IN':
'libxt.so/NS/IN':
'libz.so/NS/IN':
'linux-gate.so/NS/IN':
'liux-gate.so/NS/IN':
'low.so/NS/IN':
'mod_jk.so/NS/IN':
'more.so/NS/IN':
'much.so/NS/IN':
'mysql.so/NS/IN':
'nfsplugin.so/NS/IN':
'nppdf.so/NS/IN':
'ok.so/NS/IN':
'openvpn-auth-pam.so/NS/IN':
'own.so/NS/IN':
'pam_ldap.so/NS/IN':
'pam_mysql.so/NS/IN':
'pam_unix.so/NS/IN':
'pam_xauth.so/NS/IN':
'pints.so/NS/IN':
'prrprr.so/NS/IN':
'qtbcplin.so/NS/IN':
'read.so/NS/IN':
'rrdplugin.so/NS/IN':
'servers.so/NS/IN':
'sflowplugin.so/NS/IN':
'shiver.so/NS/IN':
'singing.so/NS/IN':
'spams.so/NS/IN':
'spirits.so/NS/IN':
'terry.so/NS/IN':
'tone.so/NS/IN':
'xineplug_inp_http.so/NS/IN':
'xmldumpplugin.so/NS/IN':

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/