Bv9ARM.ch07.html revision 984c2e9f76e66e86f7d9aca99a774836ddf196ea
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
fcb54ce0a4f7377486df5bec83b3aa4711bf4131Mark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews - Permission to use, copy, modify, and distribute this software for any
5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews - purpose with or without fee is hereby granted, provided that the above
5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews - copyright notice and this permission notice appear in all copies.
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - PERFORMANCE OF THIS SOFTWARE.
5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews<!-- $Id: Bv9ARM.ch07.html,v 1.167 2008/06/24 01:12:02 tbox Exp $ -->
0c310d16b05ee94743d33f6920907edee6084fc8Michael Graff<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
de153390f5a1f6d4fa86af91d4cae772d9846ca0Mark Andrews<title>Chapter�7.�BIND 9 Security Considerations</title>
0c310d16b05ee94743d33f6920907edee6084fc8Michael Graff<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
822f6cdabb1edd44472c7a758b5cae71376fa9beBrian Wellington<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
ebfcb6cf66283096ebda1503b6cc042ce86b6bedBrian Wellington<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews<link rel="prev" href="Bv9ARM.ch06.html" title="Chapter�6.�BIND 9 Configuration Reference">
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence<link rel="next" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
25a66b4e41e2b0a2af4840749bac80ae78c678bfMark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
21f1794606dce19928cf455029e173321f166380Mark Andrews<table width="100%" summary="Navigation header">
973a19342597823f111fce6a8cd5adfd0e2e7c0dMark Andrews<tr><th colspan="3" align="center">Chapter�7.�<acronym class="acronym">BIND</acronym> 9 Security Considerations</th></tr>
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence<div class="titlepage"><div><div><h2 class="title">
54c26ab21c61c6d6b1e484bb88dc3ac263845d17Mark Andrews<a name="Bv9ARM.ch07"></a>Chapter�7.�<acronym class="acronym">BIND</acronym> 9 Security Considerations</h2></div></div></div>
5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt>
9ac7076ebad044afb15e9e2687e3696868778538Mark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2597361"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt>
9ac7076ebad044afb15e9e2687e3696868778538Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2597506">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
9ac7076ebad044afb15e9e2687e3696868778538Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2597565">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
9ac7076ebad044afb15e9e2687e3696868778538Mark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt>
9ac7076ebad044afb15e9e2687e3696868778538Mark Andrews<div class="titlepage"><div><div><h2 class="title" style="clear: both">
9ac7076ebad044afb15e9e2687e3696868778538Mark Andrews<a name="Access_Control_Lists"></a>Access Control Lists</h2></div></div></div>
9ac7076ebad044afb15e9e2687e3696868778538Mark Andrews Access Control Lists (ACLs), are address match lists that
9ac7076ebad044afb15e9e2687e3696868778538Mark Andrews you can set up and nickname for future use in <span><strong class="command">allow-notify</strong></span>,
eb6bd543c7d072efdca509eb17f8f301c1467b53Mark Andrews <span><strong class="command">allow-query</strong></span>, <span><strong class="command">allow-query-on</strong></span>,
deaaf94332abbfdb3aff53675546acfed16e5eb6Mark Andrews <span><strong class="command">allow-recursion</strong></span>, <span><strong class="command">allow-recursion-on</strong></span>,
c46f10e4a1702191b003cf8f8fc5059c15d29c48Mark Andrews <span><strong class="command">blackhole</strong></span>, <span><strong class="command">allow-transfer</strong></span>,
2047977ce2dfcfe3a0fa2d638c3242841310fad3Mark Andrews Using ACLs allows you to have finer control over who can access
bddfe77128b0f16af263ff149db40f0d885f43d0Mark Andrews your name server, without cluttering up your config files with huge
6d12fdf96621801e80f3f4c2a8a569fe48766a20David Lawrence lists of IP addresses.
6d12fdf96621801e80f3f4c2a8a569fe48766a20David Lawrence It is a <span class="emphasis"><em>good idea</em></span> to use ACLs, and to
0b056755b2f423ba5f6adac8f7851d78f7d11437David Lawrence control access to your server. Limiting access to your server by
6d12fdf96621801e80f3f4c2a8a569fe48766a20David Lawrence outside parties can help prevent spoofing and denial of service (DoS) attacks against
2047977ce2dfcfe3a0fa2d638c3242841310fad3Mark Andrews your server.
6d12fdf96621801e80f3f4c2a8a569fe48766a20David Lawrence Here is an example of how to properly apply ACLs:
6d12fdf96621801e80f3f4c2a8a569fe48766a20David Lawrence// Set up an ACL named "bogusnets" that will block RFC1918 space
0b056755b2f423ba5f6adac8f7851d78f7d11437David Lawrence// and some reserved space, which is commonly used in spoofing attacks.
6d12fdf96621801e80f3f4c2a8a569fe48766a20David Lawrenceacl bogusnets {
6d12fdf96621801e80f3f4c2a8a569fe48766a20David Lawrence 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3;
6d12fdf96621801e80f3f4c2a8a569fe48766a20David Lawrence// Set up an ACL called our-nets. Replace this with the real IP numbers.
6d12fdf96621801e80f3f4c2a8a569fe48766a20David Lawrence allow-query { our-nets; };
2047977ce2dfcfe3a0fa2d638c3242841310fad3Mark Andrews allow-recursion { our-nets; };
2047977ce2dfcfe3a0fa2d638c3242841310fad3Mark Andrews blackhole { bogusnets; };
0c8649cea98afc061dd2938fd315df53b8fc35caAndreas Gustafsson allow-query { any; };
0c8649cea98afc061dd2938fd315df53b8fc35caAndreas Gustafsson This allows recursive queries of the server from the outside
0c8649cea98afc061dd2938fd315df53b8fc35caAndreas Gustafsson unless recursion has been previously disabled.
0c8649cea98afc061dd2938fd315df53b8fc35caAndreas Gustafsson For more information on how to use ACLs to protect your server,
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence see the <span class="emphasis"><em>AUSCERT</em></span> advisory at:
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence <a href="ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos" target="_top">ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos</a>
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence<div class="titlepage"><div><div><h2 class="title" style="clear: both">
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence<a name="id2597361"></a><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span>
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence On UNIX servers, it is possible to run <acronym class="acronym">BIND</acronym> in a <span class="emphasis"><em>chrooted</em></span> environment
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence (using the <span><strong class="command">chroot()</strong></span> function) by specifying the "<code class="option">-t</code>"
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence option. This can help improve system security by placing <acronym class="acronym">BIND</acronym> in
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence a "sandbox", which will limit the damage done if a server is
330705066b03f6ce0bc08a4bbfc5d2418038c68dBrian Wellington Another useful feature in the UNIX version of <acronym class="acronym">BIND</acronym> is the
330705066b03f6ce0bc08a4bbfc5d2418038c68dBrian Wellington ability to run the daemon as an unprivileged user ( <code class="option">-u</code> <em class="replaceable"><code>user</code></em> ).
330705066b03f6ce0bc08a4bbfc5d2418038c68dBrian Wellington We suggest running as an unprivileged user when using the <span><strong class="command">chroot</strong></span> feature.
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence Here is an example command line to load <acronym class="acronym">BIND</acronym> in a <span><strong class="command">chroot</strong></span> sandbox,
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence <span><strong class="command">/var/named</strong></span>, and to run <span><strong class="command">named</strong></span> <span><strong class="command">setuid</strong></span> to
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence <strong class="userinput"><code>/usr/local/bin/named -u 202 -t /var/named</code></strong>
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence<div class="titlepage"><div><div><h3 class="title">
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence<a name="id2597506"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div>
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence In order for a <span><strong class="command">chroot</strong></span> environment
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence work properly in a particular directory
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence (for example, <code class="filename">/var/named</code>),
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence you will need to set up an environment that includes everything
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence <acronym class="acronym">BIND</acronym> needs to run.
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence From <acronym class="acronym">BIND</acronym>'s point of view, <code class="filename">/var/named</code> is
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence the root of the filesystem. You will need to adjust the values of
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence like <span><strong class="command">directory</strong></span> and <span><strong class="command">pid-file</strong></span> to account
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence Unlike with earlier versions of BIND, you typically will
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence <span class="emphasis"><em>not</em></span> need to compile <span><strong class="command">named</strong></span>
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence statically nor install shared libraries under the new root.
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence However, depending on your operating system, you may need
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence to set up things like
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence <code class="filename">/etc/localtime</code>.
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence<div class="titlepage"><div><div><h3 class="title">
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence<a name="id2597565"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div>
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence Prior to running the <span><strong class="command">named</strong></span> daemon,
76c8294c81fb48b1da6e1fc5b83322a4cedb8e58Andreas Gustafsson the <span><strong class="command">touch</strong></span> utility (to change file
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence modification times) or the <span><strong class="command">chown</strong></span>
6d12fdf96621801e80f3f4c2a8a569fe48766a20David Lawrence to which you want <acronym class="acronym">BIND</acronym>
fd4810861c0c0ccb9aebde94e9d289442b2630dbMark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
fd4810861c0c0ccb9aebde94e9d289442b2630dbMark Andrews Note that if the <span><strong class="command">named</strong></span> daemon is running as an
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence unprivileged user, it will not be able to bind to new restricted
8abddcd3f24476b945419659e7cb73bcb970886bDavid Lawrence ports if the server is reloaded.
2047977ce2dfcfe3a0fa2d638c3242841310fad3Mark Andrews<div class="titlepage"><div><div><h2 class="title" style="clear: both">
2047977ce2dfcfe3a0fa2d638c3242841310fad3Mark Andrews<a name="dynamic_update_security"></a>Dynamic Update Security</h2></div></div></div>
bddfe77128b0f16af263ff149db40f0d885f43d0Mark Andrews Access to the dynamic
bddfe77128b0f16af263ff149db40f0d885f43d0Mark Andrews update facility should be strictly limited. In earlier versions of
bddfe77128b0f16af263ff149db40f0d885f43d0Mark Andrews <acronym class="acronym">BIND</acronym>, the only way to do this was
bddfe77128b0f16af263ff149db40f0d885f43d0Mark Andrews based on the IP
bddfe77128b0f16af263ff149db40f0d885f43d0Mark Andrews address of the host requesting the update, by listing an IP address
bddfe77128b0f16af263ff149db40f0d885f43d0Mark Andrews network prefix in the <span><strong class="command">allow-update</strong></span>
bddfe77128b0f16af263ff149db40f0d885f43d0Mark Andrews zone option.
bddfe77128b0f16af263ff149db40f0d885f43d0Mark Andrews This method is insecure since the source address of the update UDP
b6a0341bcb113e93bd0bc41a9f9a1fc117444da6Mark Andrews is easily forged. Also note that if the IP addresses allowed by the
b6a0341bcb113e93bd0bc41a9f9a1fc117444da6Mark Andrews <span><strong class="command">allow-update</strong></span> option include the
aa05bbdef7f7827dde158dcc913f4dade84c8511Brian Wellington address of a slave
23cb957a81a51a9656917ea98d0ae56b7abdcaccMark Andrews server which performs forwarding of dynamic updates, the master can
bddfe77128b0f16af263ff149db40f0d885f43d0Mark Andrews trivially attacked by sending the update to the slave, which will
bddfe77128b0f16af263ff149db40f0d885f43d0Mark Andrews forward it to the master with its own source IP address causing the
bddfe77128b0f16af263ff149db40f0d885f43d0Mark Andrews master to approve it without question.
2002be4f65776451676df6ee21a2e28f52bcad6dMark Andrews For these reasons, we strongly recommend that updates be
2002be4f65776451676df6ee21a2e28f52bcad6dMark Andrews cryptographically authenticated by means of transaction signatures
2002be4f65776451676df6ee21a2e28f52bcad6dMark Andrews (TSIG). That is, the <span><strong class="command">allow-update</strong></span>
78838d3e0cd62423c23de5503910e01884d2104bBrian Wellington option should
2002be4f65776451676df6ee21a2e28f52bcad6dMark Andrews list only TSIG key names, not IP addresses or network
2002be4f65776451676df6ee21a2e28f52bcad6dMark Andrews prefixes. Alternatively, the new <span><strong class="command">update-policy</strong></span>
2002be4f65776451676df6ee21a2e28f52bcad6dMark Andrews option can be used.
2002be4f65776451676df6ee21a2e28f52bcad6dMark Andrews Some sites choose to keep all dynamically-updated DNS data
2002be4f65776451676df6ee21a2e28f52bcad6dMark Andrews in a subdomain and delegate that subdomain to a separate zone. This
2002be4f65776451676df6ee21a2e28f52bcad6dMark Andrews way, the top-level zone containing critical data such as the IP
2002be4f65776451676df6ee21a2e28f52bcad6dMark Andrews of public web and mail servers need not allow dynamic update at
2002be4f65776451676df6ee21a2e28f52bcad6dMark Andrews<table width="100%" summary="Navigation footer">
5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
5d51e67c3b4f35c1be742574aacc1d88fe6ed444Mark Andrews<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
8d3e74b1683f714a484bbcf73249e8ee470e36d7Mark Andrews<td width="40%" align="left" valign="top">Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference�</td>
8d3e74b1683f714a484bbcf73249e8ee470e36d7Mark Andrews<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
8d3e74b1683f714a484bbcf73249e8ee470e36d7Mark Andrews<td width="40%" align="right" valign="top">�Chapter�8.�Troubleshooting</td>