Bv9ARM.ch07.html revision 7c0ebe385b36d64c2424dd5a3e62d441c08e7037
199767f8919635c4928607450d9e0abb932109ceToomas Soome>BIND 9 Security Considerations</TITLE
199767f8919635c4928607450d9e0abb932109ceToomas SoomeNAME="GENERATOR"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCONTENT="Modular DocBook HTML Stylesheet Version 1.61
199767f8919635c4928607450d9e0abb932109ceToomas SoomeTITLE="BIND 9 Administrator Reference Manual"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeREL="PREVIOUS"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeTITLE="BIND 9 Configuration Reference"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeTITLE="Troubleshooting"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="chapter"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeBGCOLOR="#FFFFFF"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeTEXT="#000000"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeLINK="#0000FF"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeVLINK="#840084"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeALINK="#0000FF"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="NAVHEADER"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCELLPADDING="0"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCELLSPACING="0"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeALIGN="center"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>BIND 9 Administrator Reference Manual</TH
199767f8919635c4928607450d9e0abb932109ceToomas SoomeVALIGN="bottom"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeALIGN="center"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeVALIGN="bottom"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeALIGN="right"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeVALIGN="bottom"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="chapter"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>Chapter 7. <SPAN
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="acronym"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> 9 Security Considerations</A
199767f8919635c4928607450d9e0abb932109ceToomas Soome>Table of Contents</B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeHREF="Bv9ARM.ch07.html#Access_Control_Lists"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>Access Control Lists</A
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeUNIX servers)</A
199767f8919635c4928607450d9e0abb932109ceToomas SoomeHREF="Bv9ARM.ch07.html#dynamic_update_security"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>Dynamic Update Security</A
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="sect1"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="sect1"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeNAME="Access_Control_Lists"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>7.1. Access Control Lists</A
199767f8919635c4928607450d9e0abb932109ceToomas Soome>Access Control Lists (ACLs), are address match lists that
199767f8919635c4928607450d9e0abb932109ceToomas Soomeyou can set up and nickname for future use in <B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>allow-notify</B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>allow-query</B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>allow-recursion</B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>blackhole</B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>allow-transfer</B
199767f8919635c4928607450d9e0abb932109ceToomas Soome>Using ACLs allows you to have finer control over who can access
199767f8919635c4928607450d9e0abb932109ceToomas Soomeyour nameserver, without cluttering up your config files with huge
199767f8919635c4928607450d9e0abb932109ceToomas Soomelists of IP addresses.</P
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="emphasis"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>good idea</I
199767f8919635c4928607450d9e0abb932109ceToomas Soome> to use ACLs, and to
199767f8919635c4928607450d9e0abb932109ceToomas Soomecontrol access to your server. Limiting access to your server by
199767f8919635c4928607450d9e0abb932109ceToomas Soomeoutside parties can help prevent spoofing and DoS attacks against
199767f8919635c4928607450d9e0abb932109ceToomas Soomeyour server.</P
199767f8919635c4928607450d9e0abb932109ceToomas Soome>Here is an example of how to properly apply ACLs:</P
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="programlisting"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> // Set up an ACL named "bogusnets" that will block RFC1918 space,
199767f8919635c4928607450d9e0abb932109ceToomas Soome// which is commonly used in spoofing attacks.
199767f8919635c4928607450d9e0abb932109ceToomas Soomeacl bogusnets { 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3; 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; };
199767f8919635c4928607450d9e0abb932109ceToomas Soome// Set up an ACL called our-nets. Replace this with the real IP numbers.
199767f8919635c4928607450d9e0abb932109ceToomas Soome allow-query { our-nets; };
199767f8919635c4928607450d9e0abb932109ceToomas Soome allow-recursion { our-nets; };
199767f8919635c4928607450d9e0abb932109ceToomas Soome blackhole { bogusnets; };
199767f8919635c4928607450d9e0abb932109ceToomas Soome type master;
199767f8919635c4928607450d9e0abb932109ceToomas Soome allow-query { any; };
199767f8919635c4928607450d9e0abb932109ceToomas Soome>This allows recursive queries of the server from the outside
199767f8919635c4928607450d9e0abb932109ceToomas Soomeunless recursion has been previously disabled.</P
199767f8919635c4928607450d9e0abb932109ceToomas Soome>For more information on how to use ACLs to protect your server,
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="emphasis"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> advisory at
199767f8919635c4928607450d9e0abb932109ceToomas SoomeHREF="ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeTARGET="_top"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos</A
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="sect1"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="sect1"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeNAME="AEN4003"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeUNIX servers)</A
199767f8919635c4928607450d9e0abb932109ceToomas Soome>On UNIX servers, it is possible to run <SPAN
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="acronym"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="emphasis"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> environment
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>) by specifying the "<TT
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="option"
199767f8919635c4928607450d9e0abb932109ceToomas Soomeoption. This can help improve system security by placing <SPAN
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="acronym"
199767f8919635c4928607450d9e0abb932109ceToomas Soomea "sandbox," which will limit the damage done if a server is compromised.</P
199767f8919635c4928607450d9e0abb932109ceToomas Soome>Another useful feature in the UNIX version of <SPAN
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="acronym"
199767f8919635c4928607450d9e0abb932109ceToomas Soomeability to run the daemon as a nonprivileged user ( <TT
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="option"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="replaceable"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeWe suggest running as a nonprivileged user when using the <B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> feature.</P
199767f8919635c4928607450d9e0abb932109ceToomas Soome>Here is an example command line to load <SPAN
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="acronym"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>, and to run <B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="userinput"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="sect2"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="sect2"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeNAME="AEN4026"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>7.2.1. The <B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> Environment</A
199767f8919635c4928607450d9e0abb932109ceToomas Soome>In order for a <B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> environment to
199767f8919635c4928607450d9e0abb932109ceToomas Soomework properly in a particular directory (for example, <TT
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="filename"
199767f8919635c4928607450d9e0abb932109ceToomas Soomeyou will need to set up an environment that includes everything
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="acronym"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> needs to run. From <SPAN
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="acronym"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>'s point of view, <TT
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="filename"
199767f8919635c4928607450d9e0abb932109ceToomas Soomethe root of the filesystem. You will need <TT
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="filename"
199767f8919635c4928607450d9e0abb932109ceToomas Soomeand any library directories and files that <SPAN
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="acronym"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> needs to run on
199767f8919635c4928607450d9e0abb932109ceToomas Soomeyour system. Please consult your operating system's instructions
199767f8919635c4928607450d9e0abb932109ceToomas Soomeif you need help figuring out which library files you need to copy
199767f8919635c4928607450d9e0abb932109ceToomas Soomeover to the <B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> sandbox.</P
199767f8919635c4928607450d9e0abb932109ceToomas Soome>If you are running an operating system that supports static
199767f8919635c4928607450d9e0abb932109ceToomas Soomebinaries, you can also compile <SPAN
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="acronym"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> statically and avoid the need
199767f8919635c4928607450d9e0abb932109ceToomas Soometo copy system libraries over to your <B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> sandbox.</P
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="sect2"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="sect2"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeNAME="AEN4041"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>7.2.2. Using the <B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> Function</A
199767f8919635c4928607450d9e0abb932109ceToomas Soome>Prior to running the <B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> daemon, use
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> utility (to change file access and
199767f8919635c4928607450d9e0abb932109ceToomas Soomemodification times) or the <B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> utility (to
199767f8919635c4928607450d9e0abb932109ceToomas Soomeset the user id and/or group id) on files to which you want <SPAN
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="acronym"
199767f8919635c4928607450d9e0abb932109ceToomas Soometo write. Note that if the <B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> daemon is running as a
199767f8919635c4928607450d9e0abb932109ceToomas Soomenonprivileged user, it will not be able to bind to new restricted ports if the
199767f8919635c4928607450d9e0abb932109ceToomas Soomeserver is reloaded.</P
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="sect1"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="sect1"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeNAME="dynamic_update_security"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>7.3. Dynamic Update Security</A
199767f8919635c4928607450d9e0abb932109ceToomas Soome>Access to the dynamic
199767f8919635c4928607450d9e0abb932109ceToomas Soomeupdate facility should be strictly limited. In earlier versions of
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="acronym"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> the only way to do this was based on the IP
199767f8919635c4928607450d9e0abb932109ceToomas Soomeaddress of the host requesting the update, by listing an IP address or
199767f8919635c4928607450d9e0abb932109ceToomas Soomenetwork prefix in the <B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>allow-update</B
199767f8919635c4928607450d9e0abb932109ceToomas Soome> zone option.
199767f8919635c4928607450d9e0abb932109ceToomas SoomeThis method is insecure since the source address of the update UDP packet
199767f8919635c4928607450d9e0abb932109ceToomas Soomeis easily forged. Also note that if the IP addresses allowed by the
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>allow-update</B
199767f8919635c4928607450d9e0abb932109ceToomas Soome> option include the address of a slave
199767f8919635c4928607450d9e0abb932109ceToomas Soomeserver which performs forwarding of dynamic updates, the master can be
199767f8919635c4928607450d9e0abb932109ceToomas Soometrivially attacked by sending the update to the slave, which will
199767f8919635c4928607450d9e0abb932109ceToomas Soomeforward it to the master with its own source IP address causing the
199767f8919635c4928607450d9e0abb932109ceToomas Soomemaster to approve it without question.</P
199767f8919635c4928607450d9e0abb932109ceToomas Soome>For these reasons, we strongly recommend that updates be
199767f8919635c4928607450d9e0abb932109ceToomas Soomecryptographically authenticated by means of transaction signatures
199767f8919635c4928607450d9e0abb932109ceToomas Soome(TSIG). That is, the <B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>allow-update</B
199767f8919635c4928607450d9e0abb932109ceToomas Soome> option should
199767f8919635c4928607450d9e0abb932109ceToomas Soomelist only TSIG key names, not IP addresses or network
199767f8919635c4928607450d9e0abb932109ceToomas Soomeprefixes. Alternatively, the new <B
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="command"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>update-policy</B
199767f8919635c4928607450d9e0abb932109ceToomas Soomeoption can be used.</P
199767f8919635c4928607450d9e0abb932109ceToomas Soome>Some sites choose to keep all dynamically updated DNS data
199767f8919635c4928607450d9e0abb932109ceToomas Soomein a subdomain and delegate that subdomain to a separate zone. This
199767f8919635c4928607450d9e0abb932109ceToomas Soomeway, the top-level zone containing critical data such as the IP addresses
199767f8919635c4928607450d9e0abb932109ceToomas Soomeof public web and mail servers need not allow dynamic update at
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="NAVFOOTER"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCELLPADDING="0"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCELLSPACING="0"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeALIGN="center"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeALIGN="right"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeCLASS="acronym"
199767f8919635c4928607450d9e0abb932109ceToomas Soome> 9 Configuration Reference</TD
199767f8919635c4928607450d9e0abb932109ceToomas SoomeALIGN="center"
199767f8919635c4928607450d9e0abb932109ceToomas SoomeALIGN="right"
199767f8919635c4928607450d9e0abb932109ceToomas Soome>Troubleshooting</TD