Bv9ARM.ch07.html revision 5347c0fcb04eaea19d9f39795646239f487c6207
c313914d0e66b20969215e519bbf2ab4ecf39512Tinderbox User<!--
c80e152862cc3e3207dc837fde7116bd4c0e4b9dTinderbox User - Copyright (C) 2000-2015 Internet Systems Consortium, Inc. ("ISC")
c80e152862cc3e3207dc837fde7116bd4c0e4b9dTinderbox User -
8d1b3ceb4d491ce32572f1702f37ed585eede993Evan Hunt - This Source Code Form is subject to the terms of the Mozilla Public
8d1b3ceb4d491ce32572f1702f37ed585eede993Evan Hunt - License, v. 2.0. If a copy of the MPL was not distributed with this
d77cb075aae5595e460e3299bfc1e8ea5d42b560Evan Hunt - file, You can obtain one at http://mozilla.org/MPL/2.0/.
d77cb075aae5595e460e3299bfc1e8ea5d42b560Evan Hunt-->
30ca20f720ad0887772a79e7abb25b4fa0e4b5b0Mark Andrews<html>
30ca20f720ad0887772a79e7abb25b4fa0e4b5b0Mark Andrews<head>
30ca20f720ad0887772a79e7abb25b4fa0e4b5b0Mark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
30ca20f720ad0887772a79e7abb25b4fa0e4b5b0Mark Andrews<title>Chapter�7.�BIND 9 Security Considerations</title>
30ca20f720ad0887772a79e7abb25b4fa0e4b5b0Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
701a93f5a592e4652343e049aa495d409c3ee133Mark Andrews<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
7ec97ae74e42ec21b354fd2d1366313b41d947d6Evan Hunt<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
701a93f5a592e4652343e049aa495d409c3ee133Mark Andrews<link rel="prev" href="Bv9ARM.ch06.html" title="Chapter�6.�BIND 9 Configuration Reference">
701a93f5a592e4652343e049aa495d409c3ee133Mark Andrews<link rel="next" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
002f1373374a0b72fc0329baa682917929bef168Tony Finch</head>
002f1373374a0b72fc0329baa682917929bef168Tony Finch<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews<div class="navheader">
8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews<table width="100%" summary="Navigation header">
8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews<tr><th colspan="3" align="center">Chapter�7.�<acronym class="acronym">BIND</acronym> 9 Security Considerations</th></tr>
8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews<tr>
8f1ed05dc0aae7ae6c3da6ec6d405df61257a61eMark Andrews<td width="20%" align="left">
73cf0ba4e82c6baef638ecc4e31321223f841d28Mark Andrews<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
73cf0ba4e82c6baef638ecc4e31321223f841d28Mark Andrews<th width="60%" align="center">�</th>
73cf0ba4e82c6baef638ecc4e31321223f841d28Mark Andrews<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
d8351dfc9b725b0d727be7acab6247d7d501d9a0Mark Andrews</td>
d8351dfc9b725b0d727be7acab6247d7d501d9a0Mark Andrews</tr>
d8351dfc9b725b0d727be7acab6247d7d501d9a0Mark Andrews</table>
3a29ce9c08dd31709c73e7187aebda0d360c537bEvan Hunt<hr>
3a29ce9c08dd31709c73e7187aebda0d360c537bEvan Hunt</div>
5c78f1f50e53d8e2ed51a187efc2c9a0f43b4b1bMark Andrews<div class="chapter">
f1740da065d4555039fe8bb53beb4153e3f94de3Mark Andrews<div class="titlepage"><div><div><h1 class="title">
f1740da065d4555039fe8bb53beb4153e3f94de3Mark Andrews<a name="Bv9ARM.ch07"></a>Chapter�7.�<acronym class="acronym">BIND</acronym> 9 Security Considerations</h1></div></div></div>
f1740da065d4555039fe8bb53beb4153e3f94de3Mark Andrews<div class="toc">
31c7ab4fb3f7710af87dc9c3d64c5daf9a3dea35Mark Andrews<p><b>Table of Contents</b></p>
31c7ab4fb3f7710af87dc9c3d64c5daf9a3dea35Mark Andrews<dl class="toc">
31c7ab4fb3f7710af87dc9c3d64c5daf9a3dea35Mark Andrews<dt><span class="section"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt>
31c7ab4fb3f7710af87dc9c3d64c5daf9a3dea35Mark Andrews<dt><span class="section"><a href="Bv9ARM.ch07.html#chroot_and_setuid"><span class="command"><strong>Chroot</strong></span> and <span class="command"><strong>Setuid</strong></span></a></span></dt>
31c7ab4fb3f7710af87dc9c3d64c5daf9a3dea35Mark Andrews<dd><dl>
ad309e8dfa0601d6053aaa12770a98a6940f89deEvan Hunt<dt><span class="section"><a href="Bv9ARM.ch07.html#chroot">The <span class="command"><strong>chroot</strong></span> Environment</a></span></dt>
ad309e8dfa0601d6053aaa12770a98a6940f89deEvan Hunt<dt><span class="section"><a href="Bv9ARM.ch07.html#setuid">Using the <span class="command"><strong>setuid</strong></span> Function</a></span></dt>
635e4351b04fd61ca6d853bdac6268c090b55129Mark Andrews</dl></dd>
635e4351b04fd61ca6d853bdac6268c090b55129Mark Andrews<dt><span class="section"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt>
fc04365d2f83f197c8a54545dd9cd4ce6a209940Mark Andrews</dl>
fc04365d2f83f197c8a54545dd9cd4ce6a209940Mark Andrews</div>
7cbac360bf98c0a52b2d6866ad887616c32d4d3aMark Andrews<div class="section">
7cbac360bf98c0a52b2d6866ad887616c32d4d3aMark Andrews<div class="titlepage"><div><div><h2 class="title" style="clear: both">
7cbac360bf98c0a52b2d6866ad887616c32d4d3aMark Andrews<a name="Access_Control_Lists"></a>Access Control Lists</h2></div></div></div>
1cf118a656f5fd210787908b845362077fc507f8Evan Hunt<p>
1cf118a656f5fd210787908b845362077fc507f8Evan Hunt Access Control Lists (ACLs) are address match lists that
1cf118a656f5fd210787908b845362077fc507f8Evan Hunt you can set up and nickname for future use in
1cf118a656f5fd210787908b845362077fc507f8Evan Hunt <span class="command"><strong>allow-notify</strong></span>, <span class="command"><strong>allow-query</strong></span>,
1cf118a656f5fd210787908b845362077fc507f8Evan Hunt <span class="command"><strong>allow-query-on</strong></span>, <span class="command"><strong>allow-recursion</strong></span>,
1cf118a656f5fd210787908b845362077fc507f8Evan Hunt <span class="command"><strong>blackhole</strong></span>, <span class="command"><strong>allow-transfer</strong></span>,
1cf118a656f5fd210787908b845362077fc507f8Evan Hunt <span class="command"><strong>match-clients</strong></span>, etc.
1cf118a656f5fd210787908b845362077fc507f8Evan Hunt </p>
6fb3db01acad7f5c1f4e23789fb0f2ce56cc07deMukund Sivaraman<p>
6fb3db01acad7f5c1f4e23789fb0f2ce56cc07deMukund Sivaraman Using ACLs allows you to have finer control over who can access
6fb3db01acad7f5c1f4e23789fb0f2ce56cc07deMukund Sivaraman your name server, without cluttering up your config files with huge
fd82c70695888c134287b8018296028c252d100eMukund Sivaraman lists of IP addresses.
fd82c70695888c134287b8018296028c252d100eMukund Sivaraman </p>
fd82c70695888c134287b8018296028c252d100eMukund Sivaraman<p>
fd82c70695888c134287b8018296028c252d100eMukund Sivaraman It is a <span class="emphasis"><em>good idea</em></span> to use ACLs, and to
4a53e3c2b83c476a93148eaee0272649beb221caMark Andrews control access to your server. Limiting access to your server by
4a53e3c2b83c476a93148eaee0272649beb221caMark Andrews outside parties can help prevent spoofing and denial of service
4a53e3c2b83c476a93148eaee0272649beb221caMark Andrews (DoS) attacks against your server.
2cf0fe3b8092f64f8f68ae3693fe2e73e90ad1a4Mark Andrews </p>
2cf0fe3b8092f64f8f68ae3693fe2e73e90ad1a4Mark Andrews<p>
2cf0fe3b8092f64f8f68ae3693fe2e73e90ad1a4Mark Andrews ACLs match clients on the basis of up to three characteristics:
2cf0fe3b8092f64f8f68ae3693fe2e73e90ad1a4Mark Andrews 1) The client's IP address; 2) the TSIG or SIG(0) key that was
4221d9cd1d02311fbf9b5f08a038f5af78b10b4aEvan Hunt used to sign the request, if any; and 3) an address prefix
4221d9cd1d02311fbf9b5f08a038f5af78b10b4aEvan Hunt encoded in an EDNS Client Subnet option, if any.
4221d9cd1d02311fbf9b5f08a038f5af78b10b4aEvan Hunt </p>
4221d9cd1d02311fbf9b5f08a038f5af78b10b4aEvan Hunt<p>
4221d9cd1d02311fbf9b5f08a038f5af78b10b4aEvan Hunt Here is an example of ACLs based on client addresses:
f9c410d93711fbf312a0162f1e2d3f2a5ede69afFrancis Dupont </p>
f9c410d93711fbf312a0162f1e2d3f2a5ede69afFrancis Dupont<pre class="programlisting">
f9c410d93711fbf312a0162f1e2d3f2a5ede69afFrancis Dupont// Set up an ACL named "bogusnets" that will block
f9c410d93711fbf312a0162f1e2d3f2a5ede69afFrancis Dupont// RFC1918 space and some reserved space, which is
e526027287b849f0b6ab6e069156697cbafa22c1Michał Kępień// commonly used in spoofing attacks.
e526027287b849f0b6ab6e069156697cbafa22c1Michał Kępieńacl bogusnets {
e526027287b849f0b6ab6e069156697cbafa22c1Michał Kępień 0.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3;
e526027287b849f0b6ab6e069156697cbafa22c1Michał Kępień 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16;
929329d2d66a7e1083c70a9c918381935bf12799Mukund Sivaraman};
929329d2d66a7e1083c70a9c918381935bf12799Mukund Sivaraman
929329d2d66a7e1083c70a9c918381935bf12799Mukund Sivaraman// Set up an ACL called our-nets. Replace this with the
7e1a62eea2e4ba9d6c3fc718e679b965fa514f69Mark Andrews// real IP numbers.
ec29d217ba3a2bf3e617a7b5b6708ae221bee999Mark Andrewsacl our-nets { x.x.x.x/24; x.x.x.x/21; };
ec29d217ba3a2bf3e617a7b5b6708ae221bee999Mark Andrewsoptions {
afefd754734f896bf3e0590177fff83e7cdfdf35Mark Andrews ...
afefd754734f896bf3e0590177fff83e7cdfdf35Mark Andrews ...
afefd754734f896bf3e0590177fff83e7cdfdf35Mark Andrews allow-query { our-nets; };
f0353a586c2bfbae999193cb644b6bc94c7944d8Mark Andrews allow-recursion { our-nets; };
f0353a586c2bfbae999193cb644b6bc94c7944d8Mark Andrews ...
7ff28f5befbee76048a23e504dcd3f9a44ce6209Evan Hunt blackhole { bogusnets; };
7ff28f5befbee76048a23e504dcd3f9a44ce6209Evan Hunt ...
7ff28f5befbee76048a23e504dcd3f9a44ce6209Evan Hunt};
7ff28f5befbee76048a23e504dcd3f9a44ce6209Evan Hunt
7ff28f5befbee76048a23e504dcd3f9a44ce6209Evan Huntzone "example.com" {
7ff28f5befbee76048a23e504dcd3f9a44ce6209Evan Hunt type master;
7ff28f5befbee76048a23e504dcd3f9a44ce6209Evan Hunt file "m/example.com";
7ff28f5befbee76048a23e504dcd3f9a44ce6209Evan Hunt allow-query { any; };
7ff28f5befbee76048a23e504dcd3f9a44ce6209Evan Hunt};
7ff28f5befbee76048a23e504dcd3f9a44ce6209Evan Hunt</pre>
cad79077bd5b2616bc4a7a6b3cbc0953bef8917fMark Andrews<p>
cad79077bd5b2616bc4a7a6b3cbc0953bef8917fMark Andrews This allows authoritative queries for "example.com" from any
cad79077bd5b2616bc4a7a6b3cbc0953bef8917fMark Andrews address, but recursive queries only from the networks specified
cad79077bd5b2616bc4a7a6b3cbc0953bef8917fMark Andrews in "our-nets", and no queries at all from the networks
adfe58e8e5cd1890585e92b67f1fd01989a1fa7dMark Andrews specified in "bogusnets".
adfe58e8e5cd1890585e92b67f1fd01989a1fa7dMark Andrews </p>
adfe58e8e5cd1890585e92b67f1fd01989a1fa7dMark Andrews<p>
c3237dec879f82855403ff7e3ba87b298172efd5Mark Andrews In addition to network addresses and prefixes, which are
c3237dec879f82855403ff7e3ba87b298172efd5Mark Andrews matched against the source address of the DNS request, ACLs
c3237dec879f82855403ff7e3ba87b298172efd5Mark Andrews may include <code class="option">key</code> elements, which specify the
c3237dec879f82855403ff7e3ba87b298172efd5Mark Andrews name of a TSIG or SIG(0) key, or <code class="option">ecs</code>
c3237dec879f82855403ff7e3ba87b298172efd5Mark Andrews elements, which specify a network prefix but are only matched
cb616c6d5c2ece1fac37fa6e0bca2b53d4043098Mark Andrews if that prefix matches an EDNS client subnet option included
cb616c6d5c2ece1fac37fa6e0bca2b53d4043098Mark Andrews in the request.
cb616c6d5c2ece1fac37fa6e0bca2b53d4043098Mark Andrews </p>
c0a2210466dec0cc81ebf2ffbe21693b57b9c29cMark Andrews<p>
c0a2210466dec0cc81ebf2ffbe21693b57b9c29cMark Andrews The EDNS Client Subnet (ECS) option is used by a recursive
c0a2210466dec0cc81ebf2ffbe21693b57b9c29cMark Andrews resolver to inform an authoritative name server of the network
534057c9f91a3eb6e0541f3526459c716239b337Mark Andrews address block from which the original query was received, enabling
534057c9f91a3eb6e0541f3526459c716239b337Mark Andrews authoritative servers to give different answers to the same
534057c9f91a3eb6e0541f3526459c716239b337Mark Andrews resolver for different resolver clients. An ACL containing
0f14b041328c062b1fa391887376388dfc8b2fe5Mark Andrews an element of the form
0f14b041328c062b1fa391887376388dfc8b2fe5Mark Andrews <span class="command"><strong>ecs <em class="replaceable"><code>prefix</code></em></strong></span>
0f14b041328c062b1fa391887376388dfc8b2fe5Mark Andrews will match if a request arrives in containing an ECS option
0f14b041328c062b1fa391887376388dfc8b2fe5Mark Andrews encoding an address within that prefix. If the request has no
f7f4730e563a2749629fe7fef4cd9513cd2bfab7Mark Andrews ECS option, then "ecs" elements are simply ignored. Addresses
f7f4730e563a2749629fe7fef4cd9513cd2bfab7Mark Andrews in ACLs that are not prefixed with "ecs" are matched only
1848d38f441ebf70ab21f6151bc3487a92d25b63Mark Andrews against the source address.
1848d38f441ebf70ab21f6151bc3487a92d25b63Mark Andrews </p>
2d82ed9456e72dc4373bea19d63411afe1c48962Mark Andrews<p>
2d82ed9456e72dc4373bea19d63411afe1c48962Mark Andrews When <acronym class="acronym">BIND</acronym> 9 is built with GeoIP support,
2d82ed9456e72dc4373bea19d63411afe1c48962Mark Andrews ACLs can also be used for geographic access restrictions.
a5a1cbece45e6ca68aafe3b9b995eac6b0f45dd2Mark Andrews This is done by specifying an ACL element of the form:
a5a1cbece45e6ca68aafe3b9b995eac6b0f45dd2Mark Andrews <span class="command"><strong>geoip [<span class="optional">db <em class="replaceable"><code>database</code></em></span>] <em class="replaceable"><code>field</code></em> <em class="replaceable"><code>value</code></em></strong></span>
0d6328ce5f6b799f8e7c6cbbb3b965cf29bfb7baMark Andrews </p>
0d6328ce5f6b799f8e7c6cbbb3b965cf29bfb7baMark Andrews<p>
0d6328ce5f6b799f8e7c6cbbb3b965cf29bfb7baMark Andrews The <em class="replaceable"><code>field</code></em> indicates which field
e01ef6f01c7e8f80122cd80a2e011425a0135489Mark Andrews to search for a match. Available fields are "country",
677f507de7c546c187c1505c48bc7b440545485cMark Andrews "region", "city", "continent", "postal" (postal code),
677f507de7c546c187c1505c48bc7b440545485cMark Andrews "metro" (metro code), "area" (area code), "tz" (timezone),
677f507de7c546c187c1505c48bc7b440545485cMark Andrews "isp", "org", "asnum", "domain" and "netspeed".
124cc0660c7eff8021c2422fb47441e9ca08b3f9Tinderbox User </p>
e01ef6f01c7e8f80122cd80a2e011425a0135489Mark Andrews<p>
677f507de7c546c187c1505c48bc7b440545485cMark Andrews <em class="replaceable"><code>value</code></em> is the value to search
677f507de7c546c187c1505c48bc7b440545485cMark Andrews for within the database. A string may be quoted if it
677f507de7c546c187c1505c48bc7b440545485cMark Andrews contains spaces or other special characters. If this is
677f507de7c546c187c1505c48bc7b440545485cMark Andrews an "asnum" search, then the leading "ASNNNN" string can be
677f507de7c546c187c1505c48bc7b440545485cMark Andrews used, otherwise the full description must be used (e.g.
677f507de7c546c187c1505c48bc7b440545485cMark Andrews "ASNNNN Example Company Name"). If this is a "country"
bf459d24a117ae2c54c37016430b41cd6d73491cMark Andrews search and the string is two characters long, then it must
bf459d24a117ae2c54c37016430b41cd6d73491cMark Andrews be a standard ISO-3166-1 two-letter country code, and if it
bf459d24a117ae2c54c37016430b41cd6d73491cMark Andrews is three characters long then it must be an ISO-3166-1
677f507de7c546c187c1505c48bc7b440545485cMark Andrews three-letter country code; otherwise it is the full name
677f507de7c546c187c1505c48bc7b440545485cMark Andrews of the country. Similarly, if this is a "region" search
677f507de7c546c187c1505c48bc7b440545485cMark Andrews and the string is two characters long, then it must be a
bf459d24a117ae2c54c37016430b41cd6d73491cMark Andrews standard two-letter state or province abbreviation;
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt otherwise it is the full name of the state or province.
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt </p>
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt<p>
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt The <em class="replaceable"><code>database</code></em> field indicates which
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt GeoIP database to search for a match. In most cases this is
81e3e3084980afcd61416f572c6e72d38a3808abMichał Kępień unnecessary, because most search fields can only be found in
81e3e3084980afcd61416f572c6e72d38a3808abMichał Kępień a single database. However, searches for country can be
81e3e3084980afcd61416f572c6e72d38a3808abMichał Kępień answered from the "city", "region", or "country" databases,
81e3e3084980afcd61416f572c6e72d38a3808abMichał Kępień and searches for region (i.e., state or province) can be
64d7fa3ec4785b390665860aa6bdae304b3c1d24Mark Andrews answered from the "city" or "region" databases. For these
64d7fa3ec4785b390665860aa6bdae304b3c1d24Mark Andrews search types, specifying a <em class="replaceable"><code>database</code></em>
64d7fa3ec4785b390665860aa6bdae304b3c1d24Mark Andrews will force the query to be answered from that database and no
64d7fa3ec4785b390665860aa6bdae304b3c1d24Mark Andrews other. If <em class="replaceable"><code>database</code></em> is not
64d7fa3ec4785b390665860aa6bdae304b3c1d24Mark Andrews specified, then these queries will be answered from the "city",
64d7fa3ec4785b390665860aa6bdae304b3c1d24Mark Andrews database if it is installed, or the "region" database if it is
75505befa93c993aa5d2df24a2b64eac0c34cbffMark Andrews installed, or the "country" database, in that order.
75505befa93c993aa5d2df24a2b64eac0c34cbffMark Andrews </p>
75505befa93c993aa5d2df24a2b64eac0c34cbffMark Andrews<p>
a38f07c73790170842e4523b4a474d01ca0dede1Michał Kępień By default, if a DNS query includes an EDNS Client Subnet (ECS)
a38f07c73790170842e4523b4a474d01ca0dede1Michał Kępień option which encodes a non-zero address prefix, then GeoIP ACLs
a38f07c73790170842e4523b4a474d01ca0dede1Michał Kępień will be matched against that address prefix. Otherwise, they
39d5523a8afc73cbdb4fa426de2ce071267a5d6fMark Andrews are matched against the source address of the query. To
39d5523a8afc73cbdb4fa426de2ce071267a5d6fMark Andrews prevent GeoIP ACLs from matching against ECS options, set
39d5523a8afc73cbdb4fa426de2ce071267a5d6fMark Andrews the <span class="command"><strong>geoip-use-ecs</strong></span> to <code class="literal">no</code>.
39d5523a8afc73cbdb4fa426de2ce071267a5d6fMark Andrews </p>
1f4a3c7088594d1b64cd734eb69e1fd023fde8bfMichał Kępień<p>
1f4a3c7088594d1b64cd734eb69e1fd023fde8bfMichał Kępień Some example GeoIP ACLs:
1f4a3c7088594d1b64cd734eb69e1fd023fde8bfMichał Kępień </p>
91827e6fd3851a5fe129ef5409ff45833ca01a0eMark Andrews<pre class="programlisting">geoip country US;
91827e6fd3851a5fe129ef5409ff45833ca01a0eMark Andrewsgeoip country JAP;
91827e6fd3851a5fe129ef5409ff45833ca01a0eMark Andrewsgeoip db country country Canada;
35aae5884f410180706a89a9715bf9a85eeeb4b7Michał Kępieńgeoip db region region WA;
35aae5884f410180706a89a9715bf9a85eeeb4b7Michał Kępieńgeoip city "San Francisco";
35aae5884f410180706a89a9715bf9a85eeeb4b7Michał Kępieńgeoip region Oklahoma;
57b1d64d9ae12d56973716e96f9743a00d47af4aMichał Kępieńgeoip postal 95062;
57b1d64d9ae12d56973716e96f9743a00d47af4aMichał Kępieńgeoip tz "America/Los_Angeles";
57b1d64d9ae12d56973716e96f9743a00d47af4aMichał Kępieńgeoip org "Internet Systems Consortium";
2d517e233ff3b3fcd272eb5b2e2d3db6d31a1681Michał Kępień</pre>
2d517e233ff3b3fcd272eb5b2e2d3db6d31a1681Michał Kępień<p>
2d517e233ff3b3fcd272eb5b2e2d3db6d31a1681Michał Kępień ACLs use a "first-match" logic rather than "best-match":
09c3efda414314d7edcfb2aed9463fb935fc95a6Mark Andrews if an address prefix matches an ACL element, then that ACL
09c3efda414314d7edcfb2aed9463fb935fc95a6Mark Andrews is considered to have matched even if a later element would
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews have matched more specifically. For example, the ACL
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews <span class="command"><strong> { 10/8; !10.0.0.1; }</strong></span> would actually
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews match a query from 10.0.0.1, because the first element
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews indicated that the query should be accepted, and the second
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews element is ignored.
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews </p>
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews<p>
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews When using "nested" ACLs (that is, ACLs included or referenced
09c3efda414314d7edcfb2aed9463fb935fc95a6Mark Andrews within other ACLs), a negative match of a nested ACL will
86d2f9abc8493321aacb0d540485de4d562fb734Mark Andrews the containing ACL to continue looking for matches. This
c7e57ce1b0bca9bc7da14bec485f7a7e3e4c761fMichał Kępień enables complex ACLs to be constructed, in which multiple
c7e57ce1b0bca9bc7da14bec485f7a7e3e4c761fMichał Kępień client characteristics can be checked at the same time. For
c7e57ce1b0bca9bc7da14bec485f7a7e3e4c761fMichał Kępień example, to construct an ACL which allows queries only when
3ed16e796dba90c96933c8a8a3f5b9404d8d3e61Mark Andrews it originates from a particular network <span class="emphasis"><em>and</em></span>
3ed16e796dba90c96933c8a8a3f5b9404d8d3e61Mark Andrews only when it is signed with a particular key, use:
3ed16e796dba90c96933c8a8a3f5b9404d8d3e61Mark Andrews </p>
14d8a144779b54b103d2da741a2242bf5f9052f7Mark Andrews<pre class="programlisting">
14d8a144779b54b103d2da741a2242bf5f9052f7Mark Andrewsallow-query { !{ !10/8; any; }; key example; };
14d8a144779b54b103d2da741a2242bf5f9052f7Mark Andrews</pre>
70e041bea19b6ad9522b89c2299ad315a2deaafdMark Andrews<p>
70e041bea19b6ad9522b89c2299ad315a2deaafdMark Andrews Within the nested ACL, any address that is
70e041bea19b6ad9522b89c2299ad315a2deaafdMark Andrews <span class="emphasis"><em>not</em></span> in the 10/8 network prefix will
67247b4a8304bac790648a351a95b8b0f4c512a6Mark Andrews be rejected, and this will terminate processing of the
67247b4a8304bac790648a351a95b8b0f4c512a6Mark Andrews ACL. Any address that <span class="emphasis"><em>is</em></span> in the 10/8
eeb919b6f572e033d97cf001e4cd44aaff54e5dcMichał Kępień network prefix will be accepted, but this causes a negative
eeb919b6f572e033d97cf001e4cd44aaff54e5dcMichał Kępień match of the nested ACL, so the containing ACL continues
eeb919b6f572e033d97cf001e4cd44aaff54e5dcMichał Kępień processing. The query will then be accepted if it is signed
a55438eda32ecebf43ead45b216662b7923a465fMark Andrews by the key "example", and rejected otherwise. The ACL, then,
a55438eda32ecebf43ead45b216662b7923a465fMark Andrews will only matches when <span class="emphasis"><em>both</em></span> conditions
a55438eda32ecebf43ead45b216662b7923a465fMark Andrews are true.
8de17f83cafa91a5720dd0b8c1aee5f47f6d7f09Evan Hunt </p>
8de17f83cafa91a5720dd0b8c1aee5f47f6d7f09Evan Hunt</div>
8de17f83cafa91a5720dd0b8c1aee5f47f6d7f09Evan Hunt<div class="section">
9789e54e55b61b669fb31a8b70e9655e8357dda2Mark Andrews<div class="titlepage"><div><div><h2 class="title" style="clear: both">
9789e54e55b61b669fb31a8b70e9655e8357dda2Mark Andrews<a name="chroot_and_setuid"></a><span class="command"><strong>Chroot</strong></span> and <span class="command"><strong>Setuid</strong></span>
f8362536c647625e602c8450a778a2b7ba90c9f4Mark Andrews</h2></div></div></div>
f8362536c647625e602c8450a778a2b7ba90c9f4Mark Andrews<p>
f8362536c647625e602c8450a778a2b7ba90c9f4Mark Andrews On UNIX servers, it is possible to run <acronym class="acronym">BIND</acronym>
24231e53a5c3079431f84dcddfee1e761fec7329Mark Andrews in a <span class="emphasis"><em>chrooted</em></span> environment (using
24231e53a5c3079431f84dcddfee1e761fec7329Mark Andrews the <span class="command"><strong>chroot()</strong></span> function) by specifying
24231e53a5c3079431f84dcddfee1e761fec7329Mark Andrews the <code class="option">-t</code> option for <span class="command"><strong>named</strong></span>.
24231e53a5c3079431f84dcddfee1e761fec7329Mark Andrews This can help improve system security by placing
4b669b69bae7dedda2faa09a7ade247499c1d49cMichał Kępień <acronym class="acronym">BIND</acronym> in a "sandbox", which will limit
4b669b69bae7dedda2faa09a7ade247499c1d49cMichał Kępień the damage done if a server is compromised.
4b669b69bae7dedda2faa09a7ade247499c1d49cMichał Kępień </p>
4b669b69bae7dedda2faa09a7ade247499c1d49cMichał Kępień<p>
eb11b39981689e4a20fbe95e533577eacab992b4Mukund Sivaraman Another useful feature in the UNIX version of <acronym class="acronym">BIND</acronym> is the
eb11b39981689e4a20fbe95e533577eacab992b4Mukund Sivaraman ability to run the daemon as an unprivileged user ( <code class="option">-u</code> <em class="replaceable"><code>user</code></em> ).
eb11b39981689e4a20fbe95e533577eacab992b4Mukund Sivaraman We suggest running as an unprivileged user when using the <span class="command"><strong>chroot</strong></span> feature.
8daeae9b01a2b7eb9fd6511b352b03bd7d96ae79Michał Kępień </p>
8daeae9b01a2b7eb9fd6511b352b03bd7d96ae79Michał Kępień<p>
e7c0f978425f45731b08be1363f20626b0344f23Evan Hunt Here is an example command line to load <acronym class="acronym">BIND</acronym> in a <span class="command"><strong>chroot</strong></span> sandbox,
e7c0f978425f45731b08be1363f20626b0344f23Evan Hunt <span class="command"><strong>/var/named</strong></span>, and to run <span class="command"><strong>named</strong></span> <span class="command"><strong>setuid</strong></span> to
01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt user 202:
01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </p>
01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt<p>
575e9d9e4b6beaae688f107814a320b91243a4b2Mark Andrews <strong class="userinput"><code>/usr/local/sbin/named -u 202 -t /var/named</code></strong>
575e9d9e4b6beaae688f107814a320b91243a4b2Mark Andrews </p>
575e9d9e4b6beaae688f107814a320b91243a4b2Mark Andrews<div class="section">
575e9d9e4b6beaae688f107814a320b91243a4b2Mark Andrews<div class="titlepage"><div><div><h3 class="title">
7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt<a name="chroot"></a>The <span class="command"><strong>chroot</strong></span> Environment</h3></div></div></div>
7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt<p>
7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt In order for a <span class="command"><strong>chroot</strong></span> environment
7c442d7fe06bc95432af7513764e5cc85e133648Evan Hunt to work properly in a particular directory (for example,
5e1ca7a326741a8f74e6f2b907c7e1fbf428bf80Michał Kępień <code class="filename">/var/named</code>), you will need to set
5e1ca7a326741a8f74e6f2b907c7e1fbf428bf80Michał Kępień up an environment that includes everything
5e1ca7a326741a8f74e6f2b907c7e1fbf428bf80Michał Kępień <acronym class="acronym">BIND</acronym> needs to run. From
5e1ca7a326741a8f74e6f2b907c7e1fbf428bf80Michał Kępień <acronym class="acronym">BIND</acronym>'s point of view,
ba93bc80a7bce5ba07b2f98e68f0f57402f2459cMark Andrews <code class="filename">/var/named</code> is the root of the
ba93bc80a7bce5ba07b2f98e68f0f57402f2459cMark Andrews filesystem. You will need to adjust the values of
8ed107eab48687887d45a1ceb18b712bc7209dbaTinderbox User options like <span class="command"><strong>directory</strong></span> and
ba93bc80a7bce5ba07b2f98e68f0f57402f2459cMark Andrews <span class="command"><strong>pid-file</strong></span> to account for this.
5f103158280fb2e814db305f917aa42040221623Mark Andrews </p>
5f103158280fb2e814db305f917aa42040221623Mark Andrews<p>
5f103158280fb2e814db305f917aa42040221623Mark Andrews Unlike with earlier versions of BIND, you typically will
5f103158280fb2e814db305f917aa42040221623Mark Andrews <span class="emphasis"><em>not</em></span> need to compile <span class="command"><strong>named</strong></span>
e5715e1fe12e5ad17522bd41c31e637c869d27b7Evan Hunt statically nor install shared libraries under the new root.
e5715e1fe12e5ad17522bd41c31e637c869d27b7Evan Hunt However, depending on your operating system, you may need
b7b76d6b855cd4c1152c26d34fb61af05f965c5eEvan Hunt to set up things like
b7b76d6b855cd4c1152c26d34fb61af05f965c5eEvan Hunt <code class="filename">/dev/zero</code>,
b7b76d6b855cd4c1152c26d34fb61af05f965c5eEvan Hunt <code class="filename">/dev/random</code>,
b7b76d6b855cd4c1152c26d34fb61af05f965c5eEvan Hunt <code class="filename">/dev/log</code>, and
764e2f3413ca89d09abffb3eb228c8c820bf08b8Mark Andrews <code class="filename">/etc/localtime</code>.
764e2f3413ca89d09abffb3eb228c8c820bf08b8Mark Andrews </p>
764e2f3413ca89d09abffb3eb228c8c820bf08b8Mark Andrews</div>
764e2f3413ca89d09abffb3eb228c8c820bf08b8Mark Andrews<div class="section">
a06198688faca5c7bc1a35ec0ec18bc68c07691cEvan Hunt<div class="titlepage"><div><div><h3 class="title">
a06198688faca5c7bc1a35ec0ec18bc68c07691cEvan Hunt<a name="setuid"></a>Using the <span class="command"><strong>setuid</strong></span> Function</h3></div></div></div>
a06198688faca5c7bc1a35ec0ec18bc68c07691cEvan Hunt<p>
50433a667cf0ed3ac7807768b745b0d870ff8c8bMark Andrews Prior to running the <span class="command"><strong>named</strong></span> daemon,
50433a667cf0ed3ac7807768b745b0d870ff8c8bMark Andrews use
3c12bec945ee71a38c5ba6f624abd12e2da7eea5Mark Andrews the <span class="command"><strong>touch</strong></span> utility (to change file
3c12bec945ee71a38c5ba6f624abd12e2da7eea5Mark Andrews access and
f44202ab640d22e17b4c74bdad7817622918bd27Mark Andrews modification times) or the <span class="command"><strong>chown</strong></span>
f44202ab640d22e17b4c74bdad7817622918bd27Mark Andrews utility (to
f44202ab640d22e17b4c74bdad7817622918bd27Mark Andrews set the user id and/or group id) on files
ad9772c559c6aa42f8930f4acf1a2d833a08040aMichał Kępień to which you want <acronym class="acronym">BIND</acronym>
ad9772c559c6aa42f8930f4acf1a2d833a08040aMichał Kępień to write.
ad9772c559c6aa42f8930f4acf1a2d833a08040aMichał Kępień </p>
ad9772c559c6aa42f8930f4acf1a2d833a08040aMichał Kępień<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
5d7d67f82a8913fae5f1098e111fe50edb86cd5bEvan Hunt<h3 class="title">Note</h3>
5d7d67f82a8913fae5f1098e111fe50edb86cd5bEvan Hunt<p>
5d7d67f82a8913fae5f1098e111fe50edb86cd5bEvan Hunt If the <span class="command"><strong>named</strong></span> daemon is running as an
6216df5ccded056abd5db4abac4e5cbd78c73f45Evan Hunt unprivileged user, it will not be able to bind to new restricted
6216df5ccded056abd5db4abac4e5cbd78c73f45Evan Hunt ports if the server is reloaded.
6216df5ccded056abd5db4abac4e5cbd78c73f45Evan Hunt </p>
6216df5ccded056abd5db4abac4e5cbd78c73f45Evan Hunt</div>
6216df5ccded056abd5db4abac4e5cbd78c73f45Evan Hunt</div>
6216df5ccded056abd5db4abac4e5cbd78c73f45Evan Hunt</div>
6216df5ccded056abd5db4abac4e5cbd78c73f45Evan Hunt<div class="section">
56e30ebae6fdb0bdf94419caff3a43fb2d16c5dfEvan Hunt<div class="titlepage"><div><div><h2 class="title" style="clear: both">
56e30ebae6fdb0bdf94419caff3a43fb2d16c5dfEvan Hunt<a name="dynamic_update_security"></a>Dynamic Update Security</h2></div></div></div>
56e30ebae6fdb0bdf94419caff3a43fb2d16c5dfEvan Hunt<p>
56e30ebae6fdb0bdf94419caff3a43fb2d16c5dfEvan Hunt Access to the dynamic
56e30ebae6fdb0bdf94419caff3a43fb2d16c5dfEvan Hunt update facility should be strictly limited. In earlier versions of
c85920c0b4b2d4dc605c0b1d355881925bf410afMark Andrews <acronym class="acronym">BIND</acronym>, the only way to do this was
c85920c0b4b2d4dc605c0b1d355881925bf410afMark Andrews based on the IP
0612274565d80e0ad87a19920e561cce5bddb05bEvan Hunt address of the host requesting the update, by listing an IP address
0612274565d80e0ad87a19920e561cce5bddb05bEvan Hunt or
0612274565d80e0ad87a19920e561cce5bddb05bEvan Hunt network prefix in the <span class="command"><strong>allow-update</strong></span>
0612274565d80e0ad87a19920e561cce5bddb05bEvan Hunt zone option.
f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt This method is insecure since the source address of the update UDP
f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt packet
f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt is easily forged. Also note that if the IP addresses allowed by the
f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt <span class="command"><strong>allow-update</strong></span> option include the
f592d2f76cac7115038124c510d2ba3050334b4dEvan Hunt address of a slave
4ee1fbe056e812e661b856b4b448296331a40249Michał Kępień server which performs forwarding of dynamic updates, the master can
4ee1fbe056e812e661b856b4b448296331a40249Michał Kępień be
1c8aa38b53a0494fc7d4c3439594d1913987f264Mark Andrews trivially attacked by sending the update to the slave, which will
1c8aa38b53a0494fc7d4c3439594d1913987f264Mark Andrews forward it to the master with its own source IP address causing the
1c8aa38b53a0494fc7d4c3439594d1913987f264Mark Andrews master to approve it without question.
1c8aa38b53a0494fc7d4c3439594d1913987f264Mark Andrews </p>
1c8aa38b53a0494fc7d4c3439594d1913987f264Mark Andrews<p>
43d53a4e4b2f0f9482485a8ab764137a9898ab32Evan Hunt For these reasons, we strongly recommend that updates be
43d53a4e4b2f0f9482485a8ab764137a9898ab32Evan Hunt cryptographically authenticated by means of transaction signatures
43d53a4e4b2f0f9482485a8ab764137a9898ab32Evan Hunt (TSIG). That is, the <span class="command"><strong>allow-update</strong></span>
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień option should
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień list only TSIG key names, not IP addresses or network
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień prefixes. Alternatively, the new <span class="command"><strong>update-policy</strong></span>
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień option can be used.
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień </p>
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień<p>
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień Some sites choose to keep all dynamically-updated DNS data
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień in a subdomain and delegate that subdomain to a separate zone. This
b1ce9b3d54cd072adb5275f08a9afac31cfb4c1cMichał Kępień way, the top-level zone containing critical data such as the IP
5fa4be41a383cfbf5e1d195b18c04bdbf5603710Evan Hunt addresses
5fa4be41a383cfbf5e1d195b18c04bdbf5603710Evan Hunt of public web and mail servers need not allow dynamic update at
5fa4be41a383cfbf5e1d195b18c04bdbf5603710Evan Hunt all.
2732d4922c2e72a399204320791acfd2fd3d6c7cMark Andrews </p>
2732d4922c2e72a399204320791acfd2fd3d6c7cMark Andrews</div>
2732d4922c2e72a399204320791acfd2fd3d6c7cMark Andrews</div>
24ffba17f06746257d5c009ca8ebfe6043966d20Evan Hunt<div class="navfooter">
24ffba17f06746257d5c009ca8ebfe6043966d20Evan Hunt<hr>
24ffba17f06746257d5c009ca8ebfe6043966d20Evan Hunt<table width="100%" summary="Navigation footer">
24ffba17f06746257d5c009ca8ebfe6043966d20Evan Hunt<tr>
24ffba17f06746257d5c009ca8ebfe6043966d20Evan Hunt<td width="40%" align="left">
21d58795b10a13fa7ac306f7146bdcb58b2e5165Mark Andrews<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
21d58795b10a13fa7ac306f7146bdcb58b2e5165Mark Andrews<td width="20%" align="center">�</td>
d5bd8bb71a8970d4ebc4701b3e9ec3efef4954b7Evan Hunt<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
d5bd8bb71a8970d4ebc4701b3e9ec3efef4954b7Evan Hunt</td>
d5bd8bb71a8970d4ebc4701b3e9ec3efef4954b7Evan Hunt</tr>
d5bd8bb71a8970d4ebc4701b3e9ec3efef4954b7Evan Hunt<tr>
d5bd8bb71a8970d4ebc4701b3e9ec3efef4954b7Evan Hunt<td width="40%" align="left" valign="top">Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference�</td>
d5bd8bb71a8970d4ebc4701b3e9ec3efef4954b7Evan Hunt<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
d5bd8bb71a8970d4ebc4701b3e9ec3efef4954b7Evan Hunt<td width="40%" align="right" valign="top">�Chapter�8.�Troubleshooting</td>
ad1317338af79edad878c9c3e4361798503310baMark Andrews</tr>
ad1317338af79edad878c9c3e4361798503310baMark Andrews</table>
9519bb92d7f3f35015aecb84954dd21607cc2c80Evan Hunt</div>
9519bb92d7f3f35015aecb84954dd21607cc2c80Evan Hunt<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.0b2</p>
9519bb92d7f3f35015aecb84954dd21607cc2c80Evan Hunt</body>
1c81aef28ddf0905344cc58dd3ea0ca539ef1414Evan Hunt</html>
1c81aef28ddf0905344cc58dd3ea0ca539ef1414Evan Hunt