Bv9ARM.ch07.html revision 40f508f08bb887b14739f7b64e4d0a892586948f
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync - Copyright (C) 2000-2003 Internet Software Consortium.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync - Permission to use, copy, modify, and/or distribute this software for any
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync - purpose with or without fee is hereby granted, provided that the above
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync - copyright notice and this permission notice appear in all copies.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync - PERFORMANCE OF THIS SOFTWARE.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<!-- $Id$ -->
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<title>Chapter�7.�BIND 9 Security Considerations</title>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<link rel="prev" href="Bv9ARM.ch06.html" title="Chapter�6.�BIND 9 Configuration Reference">
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<link rel="next" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<tr><th colspan="3" align="center">Chapter�7.�<acronym class="acronym">BIND</acronym> 9 Security Considerations</th></tr>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<a name="Bv9ARM.ch07"></a>Chapter�7.�<acronym class="acronym">BIND</acronym> 9 Security Considerations</h2></div></div></div>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2607768"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2607849">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2607909">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync<a name="Access_Control_Lists"></a>Access Control Lists</h2></div></div></div>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync Access Control Lists (ACLs) are address match lists that
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync you can set up and nickname for future use in
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync <span><strong class="command">allow-notify</strong></span>, <span><strong class="command">allow-query</strong></span>,
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync <span><strong class="command">allow-query-on</strong></span>, <span><strong class="command">allow-recursion</strong></span>,
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync <span><strong class="command">blackhole</strong></span>, <span><strong class="command">allow-transfer</strong></span>,
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync <span><strong class="command">match-clients</strong></span>, etc.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync Using ACLs allows you to have finer control over who can access
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync your name server, without cluttering up your config files with huge
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync lists of IP addresses.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync It is a <span class="emphasis"><em>good idea</em></span> to use ACLs, and to
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync control access to your server. Limiting access to your server by
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync outside parties can help prevent spoofing and denial of service
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync (DoS) attacks against your server.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync ACLs match clients on the basis of up to three characteristics:
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync 1) The client's IP address; 2) the TSIG or SIG(0) key that was
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync used to sign the request, if any; and 3) an address prefix
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync encoded in an EDNS Client Subnet option, if any.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync Here is an example of ACLs based on client addresses:
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync// Set up an ACL named "bogusnets" that will block
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync// RFC1918 space and some reserved space, which is
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync// commonly used in spoofing attacks.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsyncacl bogusnets {
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync// Set up an ACL called our-nets. Replace this with the
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync// real IP numbers.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync allow-query { our-nets; };
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync allow-recursion { our-nets; };
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync blackhole { bogusnets; };
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync type master;
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync allow-query { any; };
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync This allows authoritative queries for "example.com" from any
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync address, but recursive queries only from the networks specified
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync in "our-nets", and no queries at all from the networks
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync specified in "bogusnets".
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync In addition to network addresses and prefixes, which are
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync matched against the source address of the DNS request, ACLs
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync may include <code class="option">key</code> elements, which specify the
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync name of a TSIG or SIG(0) key, or <code class="option">ecs</code>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync elements, which specify a network prefix but are only matched
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync if that prefix matches an EDNS client subnet option included
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync in the request.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync The EDNS Client Subnet (ECS) option is used by a recursive
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync resolver to inform an authoritative name server of the network
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync address block from which the original query was received, enabling
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync authoritative servers to give different answers to the same
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync resolver for different resolver clients. An ACL containing
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync an element of the form
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync <span><strong class="command">ecs <em class="replaceable"><code>prefix</code></em></strong></span>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync will match if a request arrives in containing an ECS option
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync encoding an address within that prefix. If the request has no
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync ECS option, then "ecs" elements are simply ignored. Addresses
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync in ACLs that are not prefixed with "ecs" are matched only
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync against the source address.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync When <acronym class="acronym">BIND</acronym> 9 is built with GeoIP support,
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync ACLs can also be used for geographic access restrictions.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync This is done by specifying an ACL element of the form:
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync <span><strong class="command">geoip [<span class="optional">db <em class="replaceable"><code>database</code></em></span>] <em class="replaceable"><code>field</code></em> <em class="replaceable"><code>value</code></em></strong></span>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync The <em class="replaceable"><code>field</code></em> indicates which field
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync to search for a match. Available fields are "country",
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync "region", "city", "continent", "postal" (postal code),
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync "metro" (metro code), "area" (area code), "tz" (timezone),
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync "isp", "org", "asnum", "domain" and "netspeed".
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync <em class="replaceable"><code>value</code></em> is the value to search
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync for within the database. A string may be quoted if it
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync contains spaces or other special characters. If this is
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync an "asnum" search, then the leading "ASNNNN" string can be
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync used, otherwise the full description must be used (e.g.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync "ASNNNN Example Company Name"). If this is a "country"
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync search and the string is two characters long, then it must
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync be a standard ISO-3166-1 two-letter country code, and if it
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync is three characters long then it must be an ISO-3166-1
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync three-letter country code; otherwise it is the full name
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync of the country. Similarly, if this is a "region" search
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync and the string is two characters long, then it must be a
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync standard two-letter state or province abbreviation;
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync otherwise it is the full name of the state or province.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync The <em class="replaceable"><code>database</code></em> field indicates which
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync GeoIP database to search for a match. In most cases this is
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync unnecessary, because most search fields can only be found in
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync a single database. However, searches for country can be
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync answered from the "city", "region", or "country" databases,
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync and searches for region (i.e., state or province) can be
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync answered from the "city" or "region" databases. For these
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync search types, specifying a <em class="replaceable"><code>database</code></em>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync will force the query to be answered from that database and no
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync other. If <em class="replaceable"><code>database</code></em> is not
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync specified, then these queries will be answered from the "city",
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync database if it is installed, or the "region" database if it is
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync installed, or the "country" database, in that order.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync By default, if a DNS query includes an EDNS Client Subnet (ECS)
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync option which encodes a non-zero address prefix, then GeoIP ACLs
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync will be matched against that address prefix. Otherwise, they
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync are matched against the source address of the query. To
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync prevent GeoIP ACLs from matching against ECS options, set
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync the <span><strong class="command">geoip-use-ecs</strong></span> to <code class="literal">no</code>.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync Some example GeoIP ACLs:
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsyncgeoip country JAP;
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsyncgeoip db country country Canada;
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsyncgeoip db region region WA;
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsyncgeoip city "San Francisco";
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsyncgeoip region Oklahoma;
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsyncgeoip postal 95062;
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsyncgeoip org "Internet Systems Consortium";
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync ACLs use a "first-match" logic rather than "best-match":
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync if an address prefix matches an ACL element, then that ACL
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync is considered to have matched even if a later element would
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync have matched more specifically. For example, the ACL
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync <span><strong class="command"> { 10/8; !10.0.0.1; }</strong></span> would actually
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync match a query from 10.0.0.1, because the first element
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync indicated that the query should be accepted, and the second
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync element is ignored.
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync When using "nested" ACLs (that is, ACLs included or referenced
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync within other ACLs), a negative match of a nested ACL will
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync the containing ACL to continue looking for matches. This
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync enables complex ACLs to be constructed, in which multiple
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync client characteristics can be checked at the same time. For
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync example, to construct an ACL which allows queries only when
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync it originates from a particular network <span class="emphasis"><em>and</em></span>
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync only when it is signed with a particular key, use:
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsyncallow-query { !{ !10/8; any; }; key example; };
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync Within the nested ACL, any address that is
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync <span class="emphasis"><em>not</em></span> in the 10/8 network prefix will
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync be rejected, and this will terminate processing of the
03532efdc331b598d3dedc8cc7477641c3b0dd12vboxsync ACL. Any address that <span class="emphasis"><em>is</em></span> in the 10/8
<a name="id2607768"></a><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span>
ability to run the daemon as an unprivileged user ( <code class="option">-u</code> <em class="replaceable"><code>user</code></em> ).
We suggest running as an unprivileged user when using the <span><strong class="command">chroot</strong></span> feature.
Here is an example command line to load <acronym class="acronym">BIND</acronym> in a <span><strong class="command">chroot</strong></span> sandbox,
<span><strong class="command">/var/named</strong></span>, and to run <span><strong class="command">named</strong></span> <span><strong class="command">setuid</strong></span> to
<a name="id2607849"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div>
From <acronym class="acronym">BIND</acronym>'s point of view, <code class="filename">/var/named</code> is
like <span><strong class="command">directory</strong></span> and <span><strong class="command">pid-file</strong></span> to account
<span class="emphasis"><em>not</em></span> need to compile <span><strong class="command">named</strong></span>
<a name="id2607909"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div>