Bv9ARM.ch07.html revision ac93437301f55ed69bf85883a497a75598c628f9
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - Permission to use, copy, modify, and distribute this software for any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - purpose with or without fee is hereby granted, provided that the above
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - copyright notice and this permission notice appear in all copies.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater<!-- $Id: Bv9ARM.ch07.html,v 1.195 2009/05/15 01:15:46 tbox Exp $ -->
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<title>Chapter�7.�BIND 9 Security Considerations</title>
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="Bv9ARM.ch06.html" title="Chapter�6.�BIND 9 Configuration Reference">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="next" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews<tr><th colspan="3" align="center">Chapter�7.�<acronym class="acronym">BIND</acronym> 9 Security Considerations</th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title">
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews<a name="Bv9ARM.ch07"></a>Chapter�7.�<acronym class="acronym">BIND</acronym> 9 Security Considerations</h2></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt>
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2599326"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt>
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2599408">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2599467">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="Access_Control_Lists"></a>Access Control Lists</h2></div></div></div>
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater Access Control Lists (ACLs) are address match lists that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein you can set up and nickname for future use in <span><strong class="command">allow-notify</strong></span>,
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews <span><strong class="command">allow-query</strong></span>, <span><strong class="command">allow-query-on</strong></span>,
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews <span><strong class="command">allow-recursion</strong></span>, <span><strong class="command">allow-recursion-on</strong></span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">blackhole</strong></span>, <span><strong class="command">allow-transfer</strong></span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Using ACLs allows you to have finer control over who can access
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein your name server, without cluttering up your config files with huge
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein lists of IP addresses.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein It is a <span class="emphasis"><em>good idea</em></span> to use ACLs, and to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein control access to your server. Limiting access to your server by
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews outside parties can help prevent spoofing and denial of service (DoS) attacks against
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein your server.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Here is an example of how to properly apply ACLs:
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater// Set up an ACL named "bogusnets" that will block
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater// RFC1918 space and some reserved space, which is
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater// commonly used in spoofing attacks.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrewsacl bogusnets {
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24;
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater// Set up an ACL called our-nets. Replace this with the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews// real IP numbers.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce allow-query { our-nets; };
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce allow-recursion { our-nets; };
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce blackhole { bogusnets; };
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce type master;
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce allow-query { any; };
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This allows recursive queries of the server from the outside
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unless recursion has been previously disabled.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews For more information on how to use ACLs to protect your server,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews see the <span class="emphasis"><em>AUSCERT</em></span> advisory at:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a href="ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos" target="_top">ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos</a>
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater<div class="titlepage"><div><div><h2 class="title" style="clear: both">
4abdfc917e6635a7c81d1f931a0c79227e72d025Mark Andrews<a name="id2599326"></a><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span>
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater On UNIX servers, it is possible to run <acronym class="acronym">BIND</acronym>
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater in a <span class="emphasis"><em>chrooted</em></span> environment (using
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater the <span><strong class="command">chroot()</strong></span> function) by specifying
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater the "<code class="option">-t</code>" option for <span><strong class="command">named</strong></span>.
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater This can help improve system security by placing
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater <acronym class="acronym">BIND</acronym> in a "sandbox", which will limit
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the damage done if a server is compromised.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Another useful feature in the UNIX version of <acronym class="acronym">BIND</acronym> is the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ability to run the daemon as an unprivileged user ( <code class="option">-u</code> <em class="replaceable"><code>user</code></em> ).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein We suggest running as an unprivileged user when using the <span><strong class="command">chroot</strong></span> feature.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Here is an example command line to load <acronym class="acronym">BIND</acronym> in a <span><strong class="command">chroot</strong></span> sandbox,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">/var/named</strong></span>, and to run <span><strong class="command">named</strong></span> <span><strong class="command">setuid</strong></span> to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <strong class="userinput"><code>/usr/local/sbin/named -u 202 -t /var/named</code></strong>
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2599408"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein In order for a <span><strong class="command">chroot</strong></span> environment
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein work properly in a particular directory
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (for example, <code class="filename">/var/named</code>),
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews you will need to set up an environment that includes everything
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews <acronym class="acronym">BIND</acronym> needs to run.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein From <acronym class="acronym">BIND</acronym>'s point of view, <code class="filename">/var/named</code> is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the root of the filesystem. You will need to adjust the values of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein options like
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein like <span><strong class="command">directory</strong></span> and <span><strong class="command">pid-file</strong></span> to account
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Unlike with earlier versions of BIND, you typically will
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>not</em></span> need to compile <span><strong class="command">named</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein statically nor install shared libraries under the new root.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein However, depending on your operating system, you may need
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to set up things like
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2599467"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Prior to running the <span><strong class="command">named</strong></span> daemon,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the <span><strong class="command">touch</strong></span> utility (to change file
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein modification times) or the <span><strong class="command">chown</strong></span>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews to which you want <acronym class="acronym">BIND</acronym>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Note that if the <span><strong class="command">named</strong></span> daemon is running as an
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews unprivileged user, it will not be able to bind to new restricted
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews ports if the server is reloaded.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="dynamic_update_security"></a>Dynamic Update Security</h2></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Access to the dynamic
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews update facility should be strictly limited. In earlier versions of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <acronym class="acronym">BIND</acronym>, the only way to do this was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein based on the IP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein address of the host requesting the update, by listing an IP address
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein network prefix in the <span><strong class="command">allow-update</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone option.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This method is insecure since the source address of the update UDP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is easily forged. Also note that if the IP addresses allowed by the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">allow-update</strong></span> option include the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein address of a slave
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server which performs forwarding of dynamic updates, the master can
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein trivially attacked by sending the update to the slave, which will
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein forward it to the master with its own source IP address causing the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein master to approve it without question.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein For these reasons, we strongly recommend that updates be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cryptographically authenticated by means of transaction signatures
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (TSIG). That is, the <span><strong class="command">allow-update</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option should
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein list only TSIG key names, not IP addresses or network
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein prefixes. Alternatively, the new <span><strong class="command">update-policy</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option can be used.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Some sites choose to keep all dynamically-updated DNS data
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in a subdomain and delegate that subdomain to a separate zone. This
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein way, the top-level zone containing critical data such as the IP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of public web and mail servers need not allow dynamic update at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="left" valign="top">Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right" valign="top">�Chapter�8.�Troubleshooting</td>