Nameserver Selection suddenly changed from Bind to NSD

Shood

• June 27, 2018 07:10

Hello, My server surprised me today that "Nameserver Selection" is set to NSD, I'm sure that there's something happened in the server caused the changing from BIND to NSD, (of course not me who did that) because I'm always using BIND with all my servers and I've already set it to BIND when I created it for the first time. I think from my self experience that BIND is the best choice and

• 

  cPanelLauren

  • June 28, 2018 18:56

  Hello, I can't think of anything that would automatically change the nameserver selection like this If the modification was made recently through WHM you can see the change in the cPanel access logs at /usr/local/cpanel/logs/access_log and search for "doconfigurenameserver?nameserver=nsd" I did the following: grep "doconfigurenameserver?nameserver=nsd" /usr/local/cpanel/logs/access_log
  

  0
• 

  Shood

  • June 30, 2018 19:54

  Hello, I can't think of anything that would automatically change the nameserver selection like this If the modification was made recently through WHM you can see the change in the cPanel access logs at /usr/local/cpanel/logs/access_log and search for "doconfigurenameserver?nameserver=nsd" I did the following: grep "doconfigurenameserver?nameserver=nsd" /usr/local/cpanel/logs/access_log
  

  
  Hello @cPanelLauren, Of course you know better, and it's possible that me who did that by a mistake. I'm just feel strange how this done while I don't prefer NSD and I'm sure that I've set server to BIND upon setting it for the first time. Anyway, no matter what's the status of my server now NSD or BIND, the most important issue is to know if me who did this change or someone else for any reason, So if you can please make a little investigation through the listed below output in the cPanel access logs? I found this IP in the output (193.111.60.5) this IP is not for me at all, I looked it on arin.net, unfortunately I didn't get a helpful feedback. Could you please calm me, do you see this is a normal of there's something unusual? That's the output: ========= root [/]# grep "doconfigurenameserver?nameserver=nsd" /usr/local/cpanel/logs/access_log 193.111.60.5 - root [04/11/2018:12:57:13 -0000] "GET /cPanel_magic_revision_1424892677/libraries/fontawesome/css/font-awesome.min.css HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:57:13 -0000] "GET /cPanel_magic_revision_1521648433/templates/menu/top_frame.min.css HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:57:13 -0000] "GET /cPanel_magic_revision_1521648433/combined_optimized.css HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:57:13 -0000] "GET /cPanel_magic_revision_1521648433/templates/menu/command.min.css HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:57:13 -0000] "GET /cPanel_magic_revision_1521648433/themes/x/style_optimized.css HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:57:20 -0000] "GET /cPanel_magic_revision_1386192030/3rdparty/ui-fonts/open_sans/optimized/open_sans.min.css HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:57:20 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:57:20 -0000] "GET /cpsess1418036539/json-api/get_update_availability?api.version=1 HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:57:20 -0000] "POST /cpsess1418036539/json-api/nvset HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:57:14 -0000] "GET /cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/nameserverconfig" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:57:29 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:57:35 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:57:51 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:58:22 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:58:53 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:59:09 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:59:25 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:59:40 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:12:59:55 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:13:00:11 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:13:00:27 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:13:00:43 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:13:00:59 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:13:01:15 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:13:01:31 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:13:01:47 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:13:02:03 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 193.111.60.5 - root [04/11/2018:13:02:19 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087 root [/]# _
  =========

  0
• 

  cPanelLauren

  • July 02, 2018 13:29

  Hi @Shood That IP definitely changed the nameserver per the access logs on April 11th, 2018 it appears to belong to a hosting/IT provider when performing a whois lookup "Wise Internet Solutions"

  0
• 

  Shood

  • July 02, 2018 15:00

  Thank you again @cPanelLauren I understood from your reply that what happened is a safe process and no worries. 2nd: I have to contact my server provider to ask them because they who may did that. Am I right?

  0
• 

  cPanelLauren

  • July 02, 2018 15:19

  Hi @Shood If that IP address and Wise Internet Solutions is not yours I would be concerned, is that the name of your provider? Thanks!

  0
• 

  Shood

  • July 02, 2018 21:47

  Hi @cPanelLauren. No it's not, my server provider is Namecheap, I'll immediately ask them if there's a some relationship between them and WIS, if not I'll came back to you. Thank you for your cooperation.

  0
• 

  Shood

  • July 03, 2018 06:20

  Hi @cPanelLauren. All is well, my hosting provider who did that, they are already know the best and I trust them. Maybe this is my mistake from the beginning to post a thread instead of asking them before. However, please mark this as resolved (I couldn't know how to do myself) Thank you very much for your interesting.

  0
• 

  cPanelLauren

  • July 03, 2018 12:36

  Hi @Shood I am relieved to know it was your hosting provider. Thanks for updating us, I'll go ahead and mark this as resolved. Thank you.

  0

Please sign in to leave a comment.