8N/A - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") 8N/A - Copyright (C) 2000-2003 Internet Software Consortium. 8N/A - Permission to use, copy, modify, and distribute this software for any 8N/A - purpose with or without fee is hereby granted, provided that the above 8N/A - copyright notice and this permission notice appear in all copies. 8N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 8N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 8N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 8N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 8N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 8N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 8N/A - PERFORMANCE OF THIS SOFTWARE. 8N/A<
meta http-
equiv="Content-Type" content="text/html; charset=ISO-8859-1">
65N/A<
title>Chapter�7.�BIND 9 Security Considerations</
title>
8N/A<
meta name="generator" content="DocBook XSL Stylesheets V1.68.1">
8N/A<
link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
8N/A<
link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
65N/A<
body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
8N/A<
div class="navheader">
24N/A<
table width="100%" summary="Navigation header">
8N/A<
tr><
th colspan="3" align="center">Chapter�7.�<
span class="acronym">BIND</
span> 9 Security Considerations</
th></
tr>
58N/A<
td width="20%" align="left">
58N/A<
th width="60%" align="center">�</
th>
65N/A<
div class="chapter" lang="en">
8N/A<
div class="titlepage"><
div><
div><
h2 class="title">
8N/A<
a name="Bv9ARM.ch07"></
a>Chapter�7.�<
span class="acronym">BIND</
span> 9 Security Considerations</
h2></
div></
div></
div>
37N/A<
p><
b>Table of Contents</
b></
p>
8N/A<
dt><
span class="sect1"><
a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</
a></
span></
dt>
24N/A<
dt><
span class="sect1"><
a href="Bv9ARM.ch07.html#id2560807"><
span><
strong class="command">chroot</
strong></
span> and <
span><
strong class="command">setuid</
strong></
span></
a></
span></
dt>
65N/A<
dt><
span class="sect2"><
a href="Bv9ARM.ch07.html#id2560951">The <
span><
strong class="command">chroot</
strong></
span> Environment</
a></
span></
dt>
65N/A<
dt><
span class="sect2"><
a href="Bv9ARM.ch07.html#id2561011">Using the <
span><
strong class="command">setuid</
strong></
span> Function</
a></
span></
dt>
58N/A<
dt><
span class="sect1"><
a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</
a></
span></
dt>
65N/A<
div class="sect1" lang="en">
8N/A<
div class="titlepage"><
div><
div><
h2 class="title" style="clear: both">
8N/A<
a name="Access_Control_Lists"></
a>Access Control Lists</
h2></
div></
div></
div>
37N/A Access Control Lists (ACLs), are address match lists that
8N/A you can set up and nickname for future use in <
span><
strong class="command">allow-notify</
strong></
span>,
8N/A <
span><
strong class="command">allow-query</
strong></
span>, <
span><
strong class="command">allow-recursion</
strong></
span>,
24N/A <
span><
strong class="command">blackhole</
strong></
span>, <
span><
strong class="command">allow-transfer</
strong></
span>,
75N/A Using ACLs allows you to have finer control over who can access
75N/A your name server, without cluttering up your config files with huge
75N/A lists of IP addresses.
75N/A It is a <
span class="emphasis"><
em>good idea</
em></
span> to use ACLs, and to
75N/A control access to your server. Limiting access to your server by
75N/A outside parties can help prevent spoofing and DoS attacks against
75N/A Here is an example of how to properly apply ACLs:
75N/A<
pre class="programlisting">
65N/A// Set up an ACL named "bogusnets" that will block RFC1918 space
65N/A// and some reserved space, which is commonly used in spoofing attacks.
65N/A// Set up an ACL called our-nets. Replace this with the real IP numbers.
8N/A allow-query { our-nets; };
8N/A allow-recursion { our-nets; };
8N/A blackhole { bogusnets; };
50N/A allow-query { any; };
58N/A This allows recursive queries of the server from the outside
58N/A unless recursion has been previously disabled.
24N/A For more information on how to use ACLs to protect your server,
71N/A see the <
span class="emphasis"><
em>AUSCERT</
em></
span> advisory at:
71N/A<
div class="sect1" lang="en">
71N/A<
div class="titlepage"><
div><
div><
h2 class="title" style="clear: both">
58N/A<
a name="id2560807"></
a><
span><
strong class="command">chroot</
strong></
span> and <
span><
strong class="command">setuid</
strong></
span></
h2></
div></
div></
div>
71N/A On UNIX servers, it is possible to run <
span class="acronym">BIND</
span> in a <
span class="emphasis"><
em>chrooted</
em></
span> environment
24N/A (<
span><
strong class="command">chroot()</
strong></
span>) by specifying the "<
code class="option">-t</
code>"
65N/A option. This can help improve system security by placing <
span class="acronym">BIND</
span> in
65N/A a "sandbox", which will limit the damage done if a server is
65N/A Another useful feature in the UNIX version of <
span class="acronym">BIND</
span> is the
65N/A ability to run the daemon as an unprivileged user ( <
code class="option">-u</
code> <
em class="replaceable"><
code>user</
code></
em> ).
65N/A We suggest running as an unprivileged user when using the <
span><
strong class="command">chroot</
strong></
span> feature.
58N/A Here is an example command line to load <
span class="acronym">BIND</
span> in a <
span><
strong class="command">chroot()</
strong></
span> sandbox,
58N/A <
span><
strong class="command">/
var/
named</
strong></
span>, and to run <
span><
strong class="command">named</
strong></
span> <
span><
strong class="command">setuid</
strong></
span> to
75N/A<
div class="sect2" lang="en">
71N/A<
div class="titlepage"><
div><
div><
h3 class="title">
71N/A<
a name="id2560951"></
a>The <
span><
strong class="command">chroot</
strong></
span> Environment</
h3></
div></
div></
div>
71N/A In order for a <
span><
strong class="command">chroot()</
strong></
span> environment
24N/A work properly in a particular directory
8N/A (for example, <
code class="filename">/
var/
named</
code>),
8N/A you will need to set up an environment that includes everything
30N/A <
span class="acronym">BIND</
span> needs to run.
25N/A From <
span class="acronym">BIND</
span>'s point of view, <
code class="filename">/
var/
named</
code> is
25N/A the root of the filesystem. You will need to adjust the values of
95N/A like <
span><
strong class="command">directory</
strong></
span> and <
span><
strong class="command">pid-file</
strong></
span> to account
95N/A Unlike with earlier versions of BIND, you will typically
95N/A <
span class="emphasis"><
em>not</
em></
span> need to compile <
span><
strong class="command">named</
strong></
span>
95N/A statically nor install shared libraries under the new root.
95N/A However, depending on your operating system, you may need
95N/A to set up things like
95N/A<
div class="sect2" lang="en">
95N/A<
div class="titlepage"><
div><
div><
h3 class="title">
95N/A<
a name="id2561011"></
a>Using the <
span><
strong class="command">setuid</
strong></
span> Function</
h3></
div></
div></
div>
95N/A Prior to running the <
span><
strong class="command">named</
strong></
span> daemon,
95N/A the <
span><
strong class="command">touch</
strong></
span> utility (to change file
95N/A modification times) or the <
span><
strong class="command">chown</
strong></
span>
95N/A to which you want <
span class="acronym">BIND</
span>
95N/A<
div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
95N/A<
h3 class="title">Note</
h3>
95N/A Note that if the <
span><
strong class="command">named</
strong></
span> daemon is running as an
95N/A unprivileged user, it will not be able to bind to new restricted
99N/A ports if the server is reloaded.
99N/A<
div class="sect1" lang="en">
99N/A<
div class="titlepage"><
div><
div><
h2 class="title" style="clear: both">
99N/A<
a name="dynamic_update_security"></
a>Dynamic Update Security</
h2></
div></
div></
div>
99N/A Access to the dynamic
99N/A update facility should be strictly limited. In earlier versions of
99N/A <
span class="acronym">BIND</
span> the only way to do this was
95N/A address of the host requesting the update, by listing an IP address
95N/A network prefix in the <
span><
strong class="command">allow-update</
strong></
span>
95N/A This method is insecure since the source address of the update UDP
95N/A is easily forged. Also note that if the IP addresses allowed by the
95N/A <
span><
strong class="command">allow-update</
strong></
span> option include the
95N/A server which performs forwarding of dynamic updates, the master can
95N/A trivially attacked by sending the update to the slave, which will
65N/A forward it to the master with its own source IP address causing the
65N/A master to approve it without question.
58N/A For these reasons, we strongly recommend that updates be
58N/A cryptographically authenticated by means of transaction signatures
58N/A (TSIG). That is, the <
span><
strong class="command">allow-update</
strong></
span>
65N/A list only TSIG key names, not IP addresses or network
65N/A prefixes. Alternatively, the new <
span><
strong class="command">update-policy</
strong></
span>
65N/A option can be used.
58N/A Some sites choose to keep all dynamically updated DNS data
58N/A in a subdomain and delegate that subdomain to a separate zone. This
58N/A way, the top-level zone containing critical data such as the IP
58N/A of public web and mail servers need not allow dynamic update at
58N/A<
div class="navfooter">
58N/A<
table width="100%" summary="Navigation footer">
58N/A<
td width="40%" align="left">
58N/A<
td width="20%" align="center">�</
td>
58N/A<
td width="40%" align="left" valign="top">Chapter�6.�<
span class="acronym">BIND</
span> 9 Configuration Reference�</
td>
58N/A<
td width="20%" align="center"><
a accesskey="h" href="Bv9ARM.html">Home</
a></
td>
58N/A<
td width="40%" align="right" valign="top">�Chapter�8.�Troubleshooting</
td>