Bv9ARM.ch07.html revision cedb0bd0c1e3c461b7e479a16d3adfd5b150f1f4
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Permission to use, copy, modify, and distribute this software for any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - purpose with or without fee is hereby granted, provided that the above
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - copyright notice and this permission notice appear in all copies.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
cedb0bd0c1e3c461b7e479a16d3adfd5b150f1f4Mark Andrews<!-- $Id: Bv9ARM.ch07.html,v 1.108 2005/10/13 03:14:04 marka Exp $ -->
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<title>Chapter�7.�BIND 9 Security Considerations</title>
cedb0bd0c1e3c461b7e479a16d3adfd5b150f1f4Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="Bv9ARM.ch06.html" title="Chapter�6.�BIND 9 Configuration Reference">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="next" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<tr><th colspan="3" align="center">Chapter�7.�<span class="acronym">BIND</span> 9 Security Considerations</th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="Bv9ARM.ch07"></a>Chapter�7.�<span class="acronym">BIND</span> 9 Security Considerations</h2></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt>
cedb0bd0c1e3c461b7e479a16d3adfd5b150f1f4Mark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2572720"><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span></a></span></dt>
cedb0bd0c1e3c461b7e479a16d3adfd5b150f1f4Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2572795">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
cedb0bd0c1e3c461b7e479a16d3adfd5b150f1f4Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2572923">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="Access_Control_Lists"></a>Access Control Lists</h2></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Access Control Lists (ACLs), are address match lists that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein you can set up and nickname for future use in <span><strong class="command">allow-notify</strong></span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">allow-query</strong></span>, <span><strong class="command">allow-recursion</strong></span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">blackhole</strong></span>, <span><strong class="command">allow-transfer</strong></span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Using ACLs allows you to have finer control over who can access
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein your name server, without cluttering up your config files with huge
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein lists of IP addresses.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein It is a <span class="emphasis"><em>good idea</em></span> to use ACLs, and to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein control access to your server. Limiting access to your server by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein outside parties can help prevent spoofing and DoS attacks against
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein your server.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Here is an example of how to properly apply ACLs:
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews// Set up an ACL named "bogusnets" that will block RFC1918 space
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews// and some reserved space, which is commonly used in spoofing attacks.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrewsacl bogusnets {
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3;
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce// Set up an ACL called our-nets. Replace this with the real IP numbers.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce allow-query { our-nets; };
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce allow-recursion { our-nets; };
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce blackhole { bogusnets; };
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce type master;
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce allow-query { any; };
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This allows recursive queries of the server from the outside
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unless recursion has been previously disabled.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein For more information on how to use ACLs to protect your server,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews see the <span class="emphasis"><em>AUSCERT</em></span> advisory at:
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <a href="ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos" target="_top">ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
cedb0bd0c1e3c461b7e479a16d3adfd5b150f1f4Mark Andrews<a name="id2572720"></a><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span></h2></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein On UNIX servers, it is possible to run <span class="acronym">BIND</span> in a <span class="emphasis"><em>chrooted</em></span> environment
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (<span><strong class="command">chroot()</strong></span>) by specifying the "<code class="option">-t</code>"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option. This can help improve system security by placing <span class="acronym">BIND</span> in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a "sandbox", which will limit the damage done if a server is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein compromised.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Another useful feature in the UNIX version of <span class="acronym">BIND</span> is the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ability to run the daemon as an unprivileged user ( <code class="option">-u</code> <em class="replaceable"><code>user</code></em> ).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein We suggest running as an unprivileged user when using the <span><strong class="command">chroot</strong></span> feature.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Here is an example command line to load <span class="acronym">BIND</span> in a <span><strong class="command">chroot()</strong></span> sandbox,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">/var/named</strong></span>, and to run <span><strong class="command">named</strong></span> <span><strong class="command">setuid</strong></span> to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <strong class="userinput"><code>/usr/local/bin/named -u 202 -t /var/named</code></strong>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
cedb0bd0c1e3c461b7e479a16d3adfd5b150f1f4Mark Andrews<a name="id2572795"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein In order for a <span><strong class="command">chroot()</strong></span> environment
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein work properly in a particular directory
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (for example, <code class="filename">/var/named</code>),
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein you will need to set up an environment that includes everything
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein From <span class="acronym">BIND</span>'s point of view, <code class="filename">/var/named</code> is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the root of the filesystem. You will need to adjust the values of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein options like
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein like <span><strong class="command">directory</strong></span> and <span><strong class="command">pid-file</strong></span> to account
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Unlike with earlier versions of BIND, you will typically
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>not</em></span> need to compile <span><strong class="command">named</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein statically nor install shared libraries under the new root.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein However, depending on your operating system, you may need
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to set up things like
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
cedb0bd0c1e3c461b7e479a16d3adfd5b150f1f4Mark Andrews<a name="id2572923"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Prior to running the <span><strong class="command">named</strong></span> daemon,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the <span><strong class="command">touch</strong></span> utility (to change file
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein modification times) or the <span><strong class="command">chown</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to which you want <span class="acronym">BIND</span>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Note that if the <span><strong class="command">named</strong></span> daemon is running as an
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews unprivileged user, it will not be able to bind to new restricted
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews ports if the server is reloaded.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="dynamic_update_security"></a>Dynamic Update Security</h2></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Access to the dynamic
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein update facility should be strictly limited. In earlier versions of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="acronym">BIND</span> the only way to do this was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein based on the IP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein address of the host requesting the update, by listing an IP address
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein network prefix in the <span><strong class="command">allow-update</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone option.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This method is insecure since the source address of the update UDP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is easily forged. Also note that if the IP addresses allowed by the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">allow-update</strong></span> option include the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein address of a slave
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server which performs forwarding of dynamic updates, the master can
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein trivially attacked by sending the update to the slave, which will
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein forward it to the master with its own source IP address causing the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein master to approve it without question.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein For these reasons, we strongly recommend that updates be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cryptographically authenticated by means of transaction signatures
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (TSIG). That is, the <span><strong class="command">allow-update</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option should
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein list only TSIG key names, not IP addresses or network
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein prefixes. Alternatively, the new <span><strong class="command">update-policy</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option can be used.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Some sites choose to keep all dynamically updated DNS data
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in a subdomain and delegate that subdomain to a separate zone. This
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein way, the top-level zone containing critical data such as the IP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of public web and mail servers need not allow dynamic update at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="left" valign="top">Chapter�6.�<span class="acronym">BIND</span> 9 Configuration Reference�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right" valign="top">�Chapter�8.�Troubleshooting</td>