Bv9ARM.ch07.html revision 1fa26403d7679235a30fbf6289f68fed5872df30
d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark Andrews<HTML
ddccd5811feff696ba460dabfb666ce61040f545Andreas Gustafsson><HEAD
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User><TITLE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND 9 Security Considerations</TITLE
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User><META
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox UserNAME="GENERATOR"
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox UserCONTENT="Modular DocBook HTML Stylesheet Version 1.73
ddccd5811feff696ba460dabfb666ce61040f545Andreas Gustafsson"><LINK
d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark AndrewsREL="HOME"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinTITLE="BIND 9 Administrator Reference Manual"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinHREF="Bv9ARM.html"><LINK
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinREL="PREVIOUS"
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox UserTITLE="BIND 9 Configuration Reference"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinHREF="Bv9ARM.ch06.html"><LINK
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox UserREL="NEXT"
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox UserTITLE="Troubleshooting"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserHREF="Bv9ARM.ch08.html"></HEAD
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User><BODY
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCLASS="chapter"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserBGCOLOR="#FFFFFF"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserTEXT="#000000"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserLINK="#0000FF"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserVLINK="#840084"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserALINK="#0000FF"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><DIV
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCLASS="NAVHEADER"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User><TABLE
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserSUMMARY="Header navigation table"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserWIDTH="100%"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserBORDER="0"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCELLPADDING="0"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCELLSPACING="0"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User><TR
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User><TH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCOLSPAN="3"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserALIGN="center"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND 9 Administrator Reference Manual</TH
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User></TR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><TR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><TD
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox UserWIDTH="10%"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinALIGN="left"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinVALIGN="bottom"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinHREF="Bv9ARM.ch06.html"
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox UserACCESSKEY="P"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>Prev</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></TD
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><TD
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox UserWIDTH="80%"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinALIGN="center"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinVALIGN="bottom"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></TD
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User><TD
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinWIDTH="10%"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinALIGN="right"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinVALIGN="bottom"
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User><A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinHREF="Bv9ARM.ch08.html"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinACCESSKEY="N"
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User>Next</A
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User></TD
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></TR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></TABLE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><HR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinALIGN="LEFT"
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox UserWIDTH="100%"></DIV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><DIV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="chapter"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><H1
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User><A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinNAME="ch07"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>Chapter 7. <SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="acronym"
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User>BIND</SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> 9 Security Considerations</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></H1
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><DIV
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox UserCLASS="TOC"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><DL
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><DT
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User><B
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User>Table of Contents</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></DT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><DT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>7.1. <A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinHREF="Bv9ARM.ch07.html#Access_Control_Lists"
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User>Access Control Lists</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></DT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><DT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>7.2. <A
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox UserHREF="Bv9ARM.ch07.html#AEN4651"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>chroot</B
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User> and <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>setuid</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> (for
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox UserUNIX servers)</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></DT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><DT
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User>7.3. <A
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox UserHREF="Bv9ARM.ch07.html#dynamic_update_security"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>Dynamic Update Security</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></DT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></DL
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></DIV
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User><DIV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect1"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><H1
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect1"
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User><A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinNAME="Access_Control_Lists"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>7.1. Access Control Lists</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></H1
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>Access Control Lists (ACLs), are address match lists that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinyou can set up and nickname for future use in <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User>allow-notify</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<B
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox UserCLASS="command"
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User>allow-query</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>, <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>allow-recursion</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>,
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User<B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>blackhole</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>, <B
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox UserCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>allow-transfer</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>,
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox Useretc.</P
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>Using ACLs allows you to have finer control over who can access
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinyour name server, without cluttering up your config files with huge
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinlists of IP addresses.</P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User>It is a <SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User>good idea</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> to use ACLs, and to
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox Usercontrol access to your server. Limiting access to your server by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinoutside parties can help prevent spoofing and DoS attacks against
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Useryour server.</P
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User><P
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User>Here is an example of how to properly apply ACLs:</P
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User><PRE
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCLASS="programlisting"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>&#13;// Set up an ACL named "bogusnets" that will block RFC1918 space,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein// which is commonly used in spoofing attacks.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinacl bogusnets { 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3; 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; };
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User// Set up an ACL called our-nets. Replace this with the real IP numbers.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox Useracl our-nets { x.x.x.x/24; x.x.x.x/21; };
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinoptions {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ...
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ...
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein allow-query { our-nets; };
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein allow-recursion { our-nets; };
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User ...
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein blackhole { bogusnets; };
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ...
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein};
a24330c4805a224191ab687d0291963062fe3355Tinderbox Userzone "example.com" {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein type master;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein file "m/example.com";
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein allow-query { any; };
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein};
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein</PRE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>This allows recursive queries of the server from the outside
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinunless recursion has been previously disabled.</P
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>For more information on how to use ACLs to protect your server,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinsee the <SPAN
61e1dc26d62c2a0059e3ca7efe2ad0f4a5b8df92Mark AndrewsCLASS="emphasis"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>AUSCERT</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> advisory at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinHREF="ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserTARGET="_top"
ddccd5811feff696ba460dabfb666ce61040f545Andreas Gustafsson>ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos</A
8eea877894ea5bcf5cdd9ca124a8601ad421d753Andreas Gustafsson></P
8eea877894ea5bcf5cdd9ca124a8601ad421d753Andreas Gustafsson></DIV
ddccd5811feff696ba460dabfb666ce61040f545Andreas Gustafsson><DIV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect1"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><H1
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect1"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User><A
ddccd5811feff696ba460dabfb666ce61040f545Andreas GustafssonNAME="AEN4651"
8eea877894ea5bcf5cdd9ca124a8601ad421d753Andreas Gustafsson>7.2. <B
8eea877894ea5bcf5cdd9ca124a8601ad421d753Andreas GustafssonCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>chroot</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> and <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>setuid</B
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User> (for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinUNIX servers)</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></H1
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>On UNIX servers, it is possible to run <SPAN
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCLASS="acronym"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>BIND</SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> in a <SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>chrooted</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> environment
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein(<B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>chroot()</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>) by specifying the "<TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="option"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>-t</TT
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinoption. This can help improve system security by placing <SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="acronym"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND</SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeina "sandbox", which will limit the damage done if a server is compromised.</P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>Another useful feature in the UNIX version of <SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="acronym"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND</SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> is the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinability to run the daemon as an unprivileged user ( <TT
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCLASS="option"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>-u</TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> <TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="replaceable"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>user</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> ).
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserWe suggest running as an unprivileged user when using the <B
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCLASS="command"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>chroot</B
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User> feature.</P
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User><P
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>Here is an example command line to load <SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="acronym"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND</SPAN
ddccd5811feff696ba460dabfb666ce61040f545Andreas Gustafsson> in a <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>chroot()</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> sandbox,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>/var/named</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>, and to run <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>named</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>setuid</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinuser 202:</P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="userinput"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>/usr/local/bin/named -u 202 -t /var/named</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><DIV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect2"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><H2
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect2"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinNAME="AEN4674"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>7.2.1. The <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>chroot</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Environment</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></H2
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User><P
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>In order for a <B
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox UserCLASS="command"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>chroot()</B
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User> environment to
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Userwork properly in a particular directory
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User(for example, <TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="filename"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>/var/named</TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>),
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinyou will need to set up an environment that includes everything
<SPAN
CLASS="acronym"
>BIND</SPAN
> needs to run.
From <SPAN
CLASS="acronym"
>BIND</SPAN
>'s point of view, <TT
CLASS="filename"
>/var/named</TT
> is
the root of the filesystem. You will need to adjust the values of options like
like <B
CLASS="command"
>directory</B
> and <B
CLASS="command"
>pid-file</B
> to account
for this.
</P
><P
>&#13;Unlike with earlier versions of BIND, you will typically
<SPAN
CLASS="emphasis"
><I
CLASS="emphasis"
>not</I
></SPAN
> need to compile <B
CLASS="command"
>named</B
>
statically nor install shared libraries under the new root.
However, depending on your operating system, you may need
to set up things like
<TT
CLASS="filename"
>/dev/zero</TT
>,
<TT
CLASS="filename"
>/dev/random</TT
>,
<TT
CLASS="filename"
>/dev/log</TT
>, and/or
<TT
CLASS="filename"
>/etc/localtime</TT
>.
</P
></DIV
><DIV
CLASS="sect2"
><H2
CLASS="sect2"
><A
NAME="AEN4692"
>7.2.2. Using the <B
CLASS="command"
>setuid</B
> Function</A
></H2
><P
>Prior to running the <B
CLASS="command"
>named</B
> daemon, use
the <B
CLASS="command"
>touch</B
> utility (to change file access and
modification times) or the <B
CLASS="command"
>chown</B
> utility (to
set the user id and/or group id) on files
to which you want <SPAN
CLASS="acronym"
>BIND</SPAN
>
to write. Note that if the <B
CLASS="command"
>named</B
> daemon is running as an
unprivileged user, it will not be able to bind to new restricted ports if the
server is reloaded.</P
></DIV
></DIV
><DIV
CLASS="sect1"
><H1
CLASS="sect1"
><A
NAME="dynamic_update_security"
>7.3. Dynamic Update Security</A
></H1
><P
>Access to the dynamic
update facility should be strictly limited. In earlier versions of
<SPAN
CLASS="acronym"
>BIND</SPAN
> the only way to do this was based on the IP
address of the host requesting the update, by listing an IP address or
network prefix in the <B
CLASS="command"
>allow-update</B
> zone option.
This method is insecure since the source address of the update UDP packet
is easily forged. Also note that if the IP addresses allowed by the
<B
CLASS="command"
>allow-update</B
> option include the address of a slave
server which performs forwarding of dynamic updates, the master can be
trivially attacked by sending the update to the slave, which will
forward it to the master with its own source IP address causing the
master to approve it without question.</P
><P
>For these reasons, we strongly recommend that updates be
cryptographically authenticated by means of transaction signatures
(TSIG). That is, the <B
CLASS="command"
>allow-update</B
> option should
list only TSIG key names, not IP addresses or network
prefixes. Alternatively, the new <B
CLASS="command"
>update-policy</B
>
option can be used.</P
><P
>Some sites choose to keep all dynamically updated DNS data
in a subdomain and delegate that subdomain to a separate zone. This
way, the top-level zone containing critical data such as the IP addresses
of public web and mail servers need not allow dynamic update at
all.</P
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="Bv9ARM.ch06.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="Bv9ARM.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="Bv9ARM.ch08.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><SPAN
CLASS="acronym"
>BIND</SPAN
> 9 Configuration Reference</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Troubleshooting</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>