Bv9ARM.ch07.html revision 5347c0fcb04eaea19d9f39795646239f487c6207
c80e152862cc3e3207dc837fde7116bd4c0e4b9dTinderbox User - Copyright (C) 2000-2015 Internet Systems Consortium, Inc. ("ISC")
8d1b3ceb4d491ce32572f1702f37ed585eede993Evan Hunt - This Source Code Form is subject to the terms of the Mozilla Public
8d1b3ceb4d491ce32572f1702f37ed585eede993Evan Hunt - License, v. 2.0. If a copy of the MPL was not distributed with this
d77cb075aae5595e460e3299bfc1e8ea5d42b560Evan Hunt - file, You can obtain one at http://mozilla.org/MPL/2.0/.
30ca20f720ad0887772a79e7abb25b4fa0e4b5b0Mark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
30ca20f720ad0887772a79e7abb25b4fa0e4b5b0Mark Andrews<title>Chapter�7.�BIND 9 Security Considerations</title>
30ca20f720ad0887772a79e7abb25b4fa0e4b5b0Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
701a93f5a592e4652343e049aa495d409c3ee133Mark Andrews<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
7ec97ae74e42ec21b354fd2d1366313b41d947d6Evan Hunt<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
701a93f5a592e4652343e049aa495d409c3ee133Mark Andrews<link rel="prev" href="Bv9ARM.ch06.html" title="Chapter�6.�BIND 9 Configuration Reference">
701a93f5a592e4652343e049aa495d409c3ee133Mark Andrews<link rel="next" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
002f1373374a0b72fc0329baa682917929bef168Tony Finch<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews<table width="100%" summary="Navigation header">
8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews<tr><th colspan="3" align="center">Chapter�7.�<acronym class="acronym">BIND</acronym> 9 Security Considerations</th></tr>
73cf0ba4e82c6baef638ecc4e31321223f841d28Mark Andrews<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
73cf0ba4e82c6baef638ecc4e31321223f841d28Mark Andrews<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
f1740da065d4555039fe8bb53beb4153e3f94de3Mark Andrews<div class="titlepage"><div><div><h1 class="title">
f1740da065d4555039fe8bb53beb4153e3f94de3Mark Andrews<a name="Bv9ARM.ch07"></a>Chapter�7.�<acronym class="acronym">BIND</acronym> 9 Security Considerations</h1></div></div></div>
31c7ab4fb3f7710af87dc9c3d64c5daf9a3dea35Mark Andrews<dt><span class="section"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt>
31c7ab4fb3f7710af87dc9c3d64c5daf9a3dea35Mark Andrews<dt><span class="section"><a href="Bv9ARM.ch07.html#chroot_and_setuid"><span class="command"><strong>Chroot</strong></span> and <span class="command"><strong>Setuid</strong></span></a></span></dt>
ad309e8dfa0601d6053aaa12770a98a6940f89deEvan Hunt<dt><span class="section"><a href="Bv9ARM.ch07.html#chroot">The <span class="command"><strong>chroot</strong></span> Environment</a></span></dt>
ad309e8dfa0601d6053aaa12770a98a6940f89deEvan Hunt<dt><span class="section"><a href="Bv9ARM.ch07.html#setuid">Using the <span class="command"><strong>setuid</strong></span> Function</a></span></dt>
635e4351b04fd61ca6d853bdac6268c090b55129Mark Andrews<dt><span class="section"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt>
7cbac360bf98c0a52b2d6866ad887616c32d4d3aMark Andrews<div class="titlepage"><div><div><h2 class="title" style="clear: both">
7cbac360bf98c0a52b2d6866ad887616c32d4d3aMark Andrews<a name="Access_Control_Lists"></a>Access Control Lists</h2></div></div></div>
1cf118a656f5fd210787908b845362077fc507f8Evan Hunt Access Control Lists (ACLs) are address match lists that
1cf118a656f5fd210787908b845362077fc507f8Evan Hunt you can set up and nickname for future use in
1cf118a656f5fd210787908b845362077fc507f8Evan Hunt <span class="command"><strong>allow-notify</strong></span>, <span class="command"><strong>allow-query</strong></span>,
1cf118a656f5fd210787908b845362077fc507f8Evan Hunt <span class="command"><strong>allow-query-on</strong></span>, <span class="command"><strong>allow-recursion</strong></span>,
1cf118a656f5fd210787908b845362077fc507f8Evan Hunt <span class="command"><strong>blackhole</strong></span>, <span class="command"><strong>allow-transfer</strong></span>,
1cf118a656f5fd210787908b845362077fc507f8Evan Hunt <span class="command"><strong>match-clients</strong></span>, etc.
6fb3db01acad7f5c1f4e23789fb0f2ce56cc07deMukund Sivaraman Using ACLs allows you to have finer control over who can access
6fb3db01acad7f5c1f4e23789fb0f2ce56cc07deMukund Sivaraman your name server, without cluttering up your config files with huge
fd82c70695888c134287b8018296028c252d100eMukund Sivaraman lists of IP addresses.
fd82c70695888c134287b8018296028c252d100eMukund Sivaraman It is a <span class="emphasis"><em>good idea</em></span> to use ACLs, and to
4a53e3c2b83c476a93148eaee0272649beb221caMark Andrews control access to your server. Limiting access to your server by
4a53e3c2b83c476a93148eaee0272649beb221caMark Andrews outside parties can help prevent spoofing and denial of service
4a53e3c2b83c476a93148eaee0272649beb221caMark Andrews (DoS) attacks against your server.
2cf0fe3b8092f64f8f68ae3693fe2e73e90ad1a4Mark Andrews ACLs match clients on the basis of up to three characteristics:
2cf0fe3b8092f64f8f68ae3693fe2e73e90ad1a4Mark Andrews 1) The client's IP address; 2) the TSIG or SIG(0) key that was
4221d9cd1d02311fbf9b5f08a038f5af78b10b4aEvan Hunt used to sign the request, if any; and 3) an address prefix
4221d9cd1d02311fbf9b5f08a038f5af78b10b4aEvan Hunt encoded in an EDNS Client Subnet option, if any.
4221d9cd1d02311fbf9b5f08a038f5af78b10b4aEvan Hunt Here is an example of ACLs based on client addresses:
f9c410d93711fbf312a0162f1e2d3f2a5ede69afFrancis Dupont// Set up an ACL named "bogusnets" that will block
f9c410d93711fbf312a0162f1e2d3f2a5ede69afFrancis Dupont// RFC1918 space and some reserved space, which is
e526027287b849f0b6ab6e069156697cbafa22c1Michał Kępień// commonly used in spoofing attacks.
e526027287b849f0b6ab6e069156697cbafa22c1Michał Kępieńacl bogusnets {
929329d2d66a7e1083c70a9c918381935bf12799Mukund Sivaraman// Set up an ACL called our-nets. Replace this with the
7e1a62eea2e4ba9d6c3fc718e679b965fa514f69Mark Andrews// real IP numbers.
afefd754734f896bf3e0590177fff83e7cdfdf35Mark Andrews allow-query { our-nets; };
f0353a586c2bfbae999193cb644b6bc94c7944d8Mark Andrews allow-recursion { our-nets; };
7ff28f5befbee76048a23e504dcd3f9a44ce6209Evan Hunt blackhole { bogusnets; };
7ff28f5befbee76048a23e504dcd3f9a44ce6209Evan Hunt type master;
7ff28f5befbee76048a23e504dcd3f9a44ce6209Evan Hunt allow-query { any; };
cad79077bd5b2616bc4a7a6b3cbc0953bef8917fMark Andrews This allows authoritative queries for "example.com" from any
cad79077bd5b2616bc4a7a6b3cbc0953bef8917fMark Andrews address, but recursive queries only from the networks specified
cad79077bd5b2616bc4a7a6b3cbc0953bef8917fMark Andrews in "our-nets", and no queries at all from the networks
adfe58e8e5cd1890585e92b67f1fd01989a1fa7dMark Andrews specified in "bogusnets".
c3237dec879f82855403ff7e3ba87b298172efd5Mark Andrews In addition to network addresses and prefixes, which are
c3237dec879f82855403ff7e3ba87b298172efd5Mark Andrews matched against the source address of the DNS request, ACLs
c3237dec879f82855403ff7e3ba87b298172efd5Mark Andrews may include <code class="option">key</code> elements, which specify the
c3237dec879f82855403ff7e3ba87b298172efd5Mark Andrews name of a TSIG or SIG(0) key, or <code class="option">ecs</code>
c3237dec879f82855403ff7e3ba87b298172efd5Mark Andrews elements, which specify a network prefix but are only matched
cb616c6d5c2ece1fac37fa6e0bca2b53d4043098Mark Andrews if that prefix matches an EDNS client subnet option included
cb616c6d5c2ece1fac37fa6e0bca2b53d4043098Mark Andrews in the request.
c0a2210466dec0cc81ebf2ffbe21693b57b9c29cMark Andrews The EDNS Client Subnet (ECS) option is used by a recursive
c0a2210466dec0cc81ebf2ffbe21693b57b9c29cMark Andrews resolver to inform an authoritative name server of the network
534057c9f91a3eb6e0541f3526459c716239b337Mark Andrews address block from which the original query was received, enabling
534057c9f91a3eb6e0541f3526459c716239b337Mark Andrews authoritative servers to give different answers to the same
534057c9f91a3eb6e0541f3526459c716239b337Mark Andrews resolver for different resolver clients. An ACL containing
0f14b041328c062b1fa391887376388dfc8b2fe5Mark Andrews an element of the form
0f14b041328c062b1fa391887376388dfc8b2fe5Mark Andrews <span class="command"><strong>ecs <em class="replaceable"><code>prefix</code></em></strong></span>
0f14b041328c062b1fa391887376388dfc8b2fe5Mark Andrews will match if a request arrives in containing an ECS option
0f14b041328c062b1fa391887376388dfc8b2fe5Mark Andrews encoding an address within that prefix. If the request has no
f7f4730e563a2749629fe7fef4cd9513cd2bfab7Mark Andrews ECS option, then "ecs" elements are simply ignored. Addresses
f7f4730e563a2749629fe7fef4cd9513cd2bfab7Mark Andrews in ACLs that are not prefixed with "ecs" are matched only
1848d38f441ebf70ab21f6151bc3487a92d25b63Mark Andrews against the source address.
2d82ed9456e72dc4373bea19d63411afe1c48962Mark Andrews When <acronym class="acronym">BIND</acronym> 9 is built with GeoIP support,
2d82ed9456e72dc4373bea19d63411afe1c48962Mark Andrews ACLs can also be used for geographic access restrictions.
a5a1cbece45e6ca68aafe3b9b995eac6b0f45dd2Mark Andrews This is done by specifying an ACL element of the form:
a5a1cbece45e6ca68aafe3b9b995eac6b0f45dd2Mark Andrews <span class="command"><strong>geoip [<span class="optional">db <em class="replaceable"><code>database</code></em></span>] <em class="replaceable"><code>field</code></em> <em class="replaceable"><code>value</code></em></strong></span>
0d6328ce5f6b799f8e7c6cbbb3b965cf29bfb7baMark Andrews The <em class="replaceable"><code>field</code></em> indicates which field
e01ef6f01c7e8f80122cd80a2e011425a0135489Mark Andrews to search for a match. Available fields are "country",
677f507de7c546c187c1505c48bc7b440545485cMark Andrews "region", "city", "continent", "postal" (postal code),
677f507de7c546c187c1505c48bc7b440545485cMark Andrews "metro" (metro code), "area" (area code), "tz" (timezone),
677f507de7c546c187c1505c48bc7b440545485cMark Andrews "isp", "org", "asnum", "domain" and "netspeed".
677f507de7c546c187c1505c48bc7b440545485cMark Andrews <em class="replaceable"><code>value</code></em> is the value to search
677f507de7c546c187c1505c48bc7b440545485cMark Andrews for within the database. A string may be quoted if it
677f507de7c546c187c1505c48bc7b440545485cMark Andrews contains spaces or other special characters. If this is
677f507de7c546c187c1505c48bc7b440545485cMark Andrews an "asnum" search, then the leading "ASNNNN" string can be
677f507de7c546c187c1505c48bc7b440545485cMark Andrews used, otherwise the full description must be used (e.g.
677f507de7c546c187c1505c48bc7b440545485cMark Andrews "ASNNNN Example Company Name"). If this is a "country"
bf459d24a117ae2c54c37016430b41cd6d73491cMark Andrews search and the string is two characters long, then it must
bf459d24a117ae2c54c37016430b41cd6d73491cMark Andrews be a standard ISO-3166-1 two-letter country code, and if it
bf459d24a117ae2c54c37016430b41cd6d73491cMark Andrews is three characters long then it must be an ISO-3166-1
677f507de7c546c187c1505c48bc7b440545485cMark Andrews three-letter country code; otherwise it is the full name
677f507de7c546c187c1505c48bc7b440545485cMark Andrews of the country. Similarly, if this is a "region" search
677f507de7c546c187c1505c48bc7b440545485cMark Andrews and the string is two characters long, then it must be a
bf459d24a117ae2c54c37016430b41cd6d73491cMark Andrews standard two-letter state or province abbreviation;
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt otherwise it is the full name of the state or province.
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt The <em class="replaceable"><code>database</code></em> field indicates which
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt GeoIP database to search for a match. In most cases this is
81e3e3084980afcd61416f572c6e72d38a3808abMichał Kępień unnecessary, because most search fields can only be found in
81e3e3084980afcd61416f572c6e72d38a3808abMichał Kępień a single database. However, searches for country can be
81e3e3084980afcd61416f572c6e72d38a3808abMichał Kępień answered from the "city", "region", or "country" databases,
81e3e3084980afcd61416f572c6e72d38a3808abMichał Kępień and searches for region (i.e., state or province) can be
64d7fa3ec4785b390665860aa6bdae304b3c1d24Mark Andrews answered from the "city" or "region" databases. For these
64d7fa3ec4785b390665860aa6bdae304b3c1d24Mark Andrews search types, specifying a <em class="replaceable"><code>database</code></em>
64d7fa3ec4785b390665860aa6bdae304b3c1d24Mark Andrews will force the query to be answered from that database and no
64d7fa3ec4785b390665860aa6bdae304b3c1d24Mark Andrews other. If <em class="replaceable"><code>database</code></em> is not
64d7fa3ec4785b390665860aa6bdae304b3c1d24Mark Andrews specified, then these queries will be answered from the "city",
64d7fa3ec4785b390665860aa6bdae304b3c1d24Mark Andrews database if it is installed, or the "region" database if it is
75505befa93c993aa5d2df24a2b64eac0c34cbffMark Andrews installed, or the "country" database, in that order.
a38f07c73790170842e4523b4a474d01ca0dede1Michał Kępień By default, if a DNS query includes an EDNS Client Subnet (ECS)
a38f07c73790170842e4523b4a474d01ca0dede1Michał Kępień option which encodes a non-zero address prefix, then GeoIP ACLs
a38f07c73790170842e4523b4a474d01ca0dede1Michał Kępień will be matched against that address prefix. Otherwise, they
39d5523a8afc73cbdb4fa426de2ce071267a5d6fMark Andrews are matched against the source address of the query. To
39d5523a8afc73cbdb4fa426de2ce071267a5d6fMark Andrews prevent GeoIP ACLs from matching against ECS options, set
39d5523a8afc73cbdb4fa426de2ce071267a5d6fMark Andrews the <span class="command"><strong>geoip-use-ecs</strong></span> to <code class="literal">no</code>.
1f4a3c7088594d1b64cd734eb69e1fd023fde8bfMichał Kępień Some example GeoIP ACLs:
91827e6fd3851a5fe129ef5409ff45833ca01a0eMark Andrewsgeoip country JAP;
91827e6fd3851a5fe129ef5409ff45833ca01a0eMark Andrewsgeoip db country country Canada;
35aae5884f410180706a89a9715bf9a85eeeb4b7Michał Kępieńgeoip db region region WA;
35aae5884f410180706a89a9715bf9a85eeeb4b7Michał Kępieńgeoip city "San Francisco";
35aae5884f410180706a89a9715bf9a85eeeb4b7Michał Kępieńgeoip region Oklahoma;
57b1d64d9ae12d56973716e96f9743a00d47af4aMichał Kępieńgeoip postal 95062;
57b1d64d9ae12d56973716e96f9743a00d47af4aMichał Kępieńgeoip org "Internet Systems Consortium";
2d517e233ff3b3fcd272eb5b2e2d3db6d31a1681Michał Kępień ACLs use a "first-match" logic rather than "best-match":
09c3efda414314d7edcfb2aed9463fb935fc95a6Mark Andrews if an address prefix matches an ACL element, then that ACL
09c3efda414314d7edcfb2aed9463fb935fc95a6Mark Andrews is considered to have matched even if a later element would
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews have matched more specifically. For example, the ACL
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews <span class="command"><strong> { 10/8; !10.0.0.1; }</strong></span> would actually
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews match a query from 10.0.0.1, because the first element
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews indicated that the query should be accepted, and the second
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews element is ignored.
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews When using "nested" ACLs (that is, ACLs included or referenced
09c3efda414314d7edcfb2aed9463fb935fc95a6Mark Andrews within other ACLs), a negative match of a nested ACL will
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews the containing ACL to continue looking for matches. This
c7e57ce1b0bca9bc7da14bec485f7a7e3e4c761fMichał Kępień enables complex ACLs to be constructed, in which multiple
c7e57ce1b0bca9bc7da14bec485f7a7e3e4c761fMichał Kępień client characteristics can be checked at the same time. For
c7e57ce1b0bca9bc7da14bec485f7a7e3e4c761fMichał Kępień example, to construct an ACL which allows queries only when
3ed16e796dba90c96933c8a8a3f5b9404d8d3e61Mark Andrews it originates from a particular network <span class="emphasis"><em>and</em></span>
3ed16e796dba90c96933c8a8a3f5b9404d8d3e61Mark Andrews only when it is signed with a particular key, use:
14d8a144779b54b103d2da741a2242bf5f9052f7Mark Andrewsallow-query { !{ !10/8; any; }; key example; };
70e041bea19b6ad9522b89c2299ad315a2deaafdMark Andrews Within the nested ACL, any address that is
70e041bea19b6ad9522b89c2299ad315a2deaafdMark Andrews <span class="emphasis"><em>not</em></span> in the 10/8 network prefix will
67247b4a8304bac790648a351a95b8b0f4c512a6Mark Andrews be rejected, and this will terminate processing of the
67247b4a8304bac790648a351a95b8b0f4c512a6Mark Andrews ACL. Any address that <span class="emphasis"><em>is</em></span> in the 10/8
eeb919b6f572e033d97cf001e4cd44aaff54e5dcMichał Kępień network prefix will be accepted, but this causes a negative
eeb919b6f572e033d97cf001e4cd44aaff54e5dcMichał Kępień match of the nested ACL, so the containing ACL continues
eeb919b6f572e033d97cf001e4cd44aaff54e5dcMichał Kępień processing. The query will then be accepted if it is signed
a55438eda32ecebf43ead45b216662b7923a465fMark Andrews by the key "example", and rejected otherwise. The ACL, then,
a55438eda32ecebf43ead45b216662b7923a465fMark Andrews will only matches when <span class="emphasis"><em>both</em></span> conditions
9789e54e55b61b669fb31a8b70e9655e8357dda2Mark Andrews<div class="titlepage"><div><div><h2 class="title" style="clear: both">
9789e54e55b61b669fb31a8b70e9655e8357dda2Mark Andrews<a name="chroot_and_setuid"></a><span class="command"><strong>Chroot</strong></span> and <span class="command"><strong>Setuid</strong></span>
f8362536c647625e602c8450a778a2b7ba90c9f4Mark Andrews On UNIX servers, it is possible to run <acronym class="acronym">BIND</acronym>
24231e53a5c3079431f84dcddfee1e761fec7329Mark Andrews in a <span class="emphasis"><em>chrooted</em></span> environment (using
24231e53a5c3079431f84dcddfee1e761fec7329Mark Andrews the <span class="command"><strong>chroot()</strong></span> function) by specifying
24231e53a5c3079431f84dcddfee1e761fec7329Mark Andrews the <code class="option">-t</code> option for <span class="command"><strong>named</strong></span>.
24231e53a5c3079431f84dcddfee1e761fec7329Mark Andrews This can help improve system security by placing
4b669b69bae7dedda2faa09a7ade247499c1d49cMichał Kępień <acronym class="acronym">BIND</acronym> in a "sandbox", which will limit
4b669b69bae7dedda2faa09a7ade247499c1d49cMichał Kępień the damage done if a server is compromised.
eb11b39981689e4a20fbe95e533577eacab992b4Mukund Sivaraman Another useful feature in the UNIX version of <acronym class="acronym">BIND</acronym> is the
eb11b39981689e4a20fbe95e533577eacab992b4Mukund Sivaraman ability to run the daemon as an unprivileged user ( <code class="option">-u</code> <em class="replaceable"><code>user</code></em> ).
eb11b39981689e4a20fbe95e533577eacab992b4Mukund Sivaraman We suggest running as an unprivileged user when using the <span class="command"><strong>chroot</strong></span> feature.
e7c0f978425f45731b08be1363f20626b0344f23Evan Hunt Here is an example command line to load <acronym class="acronym">BIND</acronym> in a <span class="command"><strong>chroot</strong></span> sandbox,
e7c0f978425f45731b08be1363f20626b0344f23Evan Hunt <span class="command"><strong>/var/named</strong></span>, and to run <span class="command"><strong>named</strong></span> <span class="command"><strong>setuid</strong></span> to
575e9d9e4b6beaae688f107814a320b91243a4b2Mark Andrews <strong class="userinput"><code>/usr/local/sbin/named -u 202 -t /var/named</code></strong>
575e9d9e4b6beaae688f107814a320b91243a4b2Mark Andrews<div class="titlepage"><div><div><h3 class="title">
7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt<a name="chroot"></a>The <span class="command"><strong>chroot</strong></span> Environment</h3></div></div></div>
7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt In order for a <span class="command"><strong>chroot</strong></span> environment
7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt to work properly in a particular directory (for example,
5e1ca7a326741a8f74e6f2b907c7e1fbf428bf80Michał Kępień <code class="filename">/var/named</code>), you will need to set
5e1ca7a326741a8f74e6f2b907c7e1fbf428bf80Michał Kępień up an environment that includes everything
5e1ca7a326741a8f74e6f2b907c7e1fbf428bf80Michał Kępień <acronym class="acronym">BIND</acronym> needs to run. From
5e1ca7a326741a8f74e6f2b907c7e1fbf428bf80Michał Kępień <acronym class="acronym">BIND</acronym>'s point of view,
ba93bc80a7bce5ba07b2f98e68f0f57402f2459cMark Andrews <code class="filename">/var/named</code> is the root of the
ba93bc80a7bce5ba07b2f98e68f0f57402f2459cMark Andrews filesystem. You will need to adjust the values of
8ed107eab48687887d45a1ceb18b712bc7209dbaTinderbox User options like <span class="command"><strong>directory</strong></span> and
ba93bc80a7bce5ba07b2f98e68f0f57402f2459cMark Andrews <span class="command"><strong>pid-file</strong></span> to account for this.
5f103158280fb2e814db305f917aa42040221623Mark Andrews Unlike with earlier versions of BIND, you typically will
5f103158280fb2e814db305f917aa42040221623Mark Andrews <span class="emphasis"><em>not</em></span> need to compile <span class="command"><strong>named</strong></span>
e5715e1fe12e5ad17522bd41c31e637c869d27b7Evan Hunt statically nor install shared libraries under the new root.
e5715e1fe12e5ad17522bd41c31e637c869d27b7Evan Hunt However, depending on your operating system, you may need
b7b76d6b855cd4c1152c26d34fb61af05f965c5eEvan Hunt to set up things like
a06198688faca5c7bc1a35ec0ec18bc68c07691cEvan Hunt<div class="titlepage"><div><div><h3 class="title">
a06198688faca5c7bc1a35ec0ec18bc68c07691cEvan Hunt<a name="setuid"></a>Using the <span class="command"><strong>setuid</strong></span> Function</h3></div></div></div>
50433a667cf0ed3ac7807768b745b0d870ff8c8bMark Andrews Prior to running the <span class="command"><strong>named</strong></span> daemon,
3c12bec945ee71a38c5ba6f624abd12e2da7eea5Mark Andrews the <span class="command"><strong>touch</strong></span> utility (to change file
f44202ab640d22e17b4c74bdad7817622918bd27Mark Andrews modification times) or the <span class="command"><strong>chown</strong></span>
ad9772c559c6aa42f8930f4acf1a2d833a08040aMichał Kępień to which you want <acronym class="acronym">BIND</acronym>
ad9772c559c6aa42f8930f4acf1a2d833a08040aMichał Kępień<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
5d7d67f82a8913fae5f1098e111fe50edb86cd5bEvan Hunt If the <span class="command"><strong>named</strong></span> daemon is running as an
6216df5ccded056abd5db4abac4e5cbd78c73f45Evan Hunt unprivileged user, it will not be able to bind to new restricted
6216df5ccded056abd5db4abac4e5cbd78c73f45Evan Hunt ports if the server is reloaded.
56e30ebae6fdb0bdf94419caff3a43fb2d16c5dfEvan Hunt<div class="titlepage"><div><div><h2 class="title" style="clear: both">
56e30ebae6fdb0bdf94419caff3a43fb2d16c5dfEvan Hunt<a name="dynamic_update_security"></a>Dynamic Update Security</h2></div></div></div>
56e30ebae6fdb0bdf94419caff3a43fb2d16c5dfEvan Hunt Access to the dynamic
56e30ebae6fdb0bdf94419caff3a43fb2d16c5dfEvan Hunt update facility should be strictly limited. In earlier versions of
c85920c0b4b2d4dc605c0b1d355881925bf410afMark Andrews <acronym class="acronym">BIND</acronym>, the only way to do this was
c85920c0b4b2d4dc605c0b1d355881925bf410afMark Andrews based on the IP
0612274565d80e0ad87a19920e561cce5bddb05bEvan Hunt address of the host requesting the update, by listing an IP address
0612274565d80e0ad87a19920e561cce5bddb05bEvan Hunt network prefix in the <span class="command"><strong>allow-update</strong></span>
0612274565d80e0ad87a19920e561cce5bddb05bEvan Hunt zone option.
f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt This method is insecure since the source address of the update UDP
f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt is easily forged. Also note that if the IP addresses allowed by the
f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt <span class="command"><strong>allow-update</strong></span> option include the
f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt address of a slave
4ee1fbe056e812e661b856b4b448296331a40249Michał Kępień server which performs forwarding of dynamic updates, the master can
1c8aa38b53a0494fc7d4c3439594d1913987f264Mark Andrews trivially attacked by sending the update to the slave, which will
1c8aa38b53a0494fc7d4c3439594d1913987f264Mark Andrews forward it to the master with its own source IP address causing the
1c8aa38b53a0494fc7d4c3439594d1913987f264Mark Andrews master to approve it without question.
43d53a4e4b2f0f9482485a8ab764137a9898ab32Evan Hunt For these reasons, we strongly recommend that updates be
43d53a4e4b2f0f9482485a8ab764137a9898ab32Evan Hunt cryptographically authenticated by means of transaction signatures
43d53a4e4b2f0f9482485a8ab764137a9898ab32Evan Hunt (TSIG). That is, the <span class="command"><strong>allow-update</strong></span>
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień option should
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień list only TSIG key names, not IP addresses or network
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień prefixes. Alternatively, the new <span class="command"><strong>update-policy</strong></span>
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień option can be used.
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień Some sites choose to keep all dynamically-updated DNS data
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień in a subdomain and delegate that subdomain to a separate zone. This
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień way, the top-level zone containing critical data such as the IP
5fa4be41a383cfbf5e1d195b18c04bdbf5603710Evan Hunt of public web and mail servers need not allow dynamic update at
21d58795b10a13fa7ac306f7146bdcb58b2e5165Mark Andrews<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
d5bd8bb71a8970d4ebc4701b3e9ec3efef4954b7Evan Hunt<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
d5bd8bb71a8970d4ebc4701b3e9ec3efef4954b7Evan Hunt<td width="40%" align="left" valign="top">Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference�</td>
d5bd8bb71a8970d4ebc4701b3e9ec3efef4954b7Evan Hunt<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
d5bd8bb71a8970d4ebc4701b3e9ec3efef4954b7Evan Hunt<td width="40%" align="right" valign="top">�Chapter�8.�Troubleshooting</td>
9519bb92d7f3f35015aecb84954dd21607cc2c80Evan Hunt<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.0b2</p>