0N/A - Copyright (C) 2004-2013 Internet Systems Consortium, Inc. ("ISC") 0N/A - Copyright (C) 2000-2003 Internet Software Consortium. 0N/A - Permission to use, copy, modify, and/or distribute this software for any 0N/A - purpose with or without fee is hereby granted, provided that the above 0N/A - copyright notice and this permission notice appear in all copies. 0N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 0N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 0N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 0N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 0N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 0N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 0N/A - PERFORMANCE OF THIS SOFTWARE. 0N/A<
meta http-
equiv="Content-Type" content="text/html; charset=ISO-8859-1">
0N/A<
title>Chapter�7.�BIND 9 Security Considerations</
title>
0N/A<
meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
0N/A<
link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
0N/A<
link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
0N/A<
body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
0N/A<
div class="navheader">
0N/A<
table width="100%" summary="Navigation header">
1242N/A<
tr><
th colspan="3" align="center">Chapter�7.�<
acronym class="acronym">BIND</
acronym> 9 Security Considerations</
th></
tr>
1242N/A<
td width="20%" align="left">
1242N/A<
th width="60%" align="center">�</
th>
1242N/A<
div class="chapter" lang="en">
1242N/A<
div class="titlepage"><
div><
div><
h2 class="title">
1242N/A<
a name="Bv9ARM.ch07"></
a>Chapter�7.�<
acronym class="acronym">BIND</
acronym> 9 Security Considerations</
h2></
div></
div></
div>
1242N/A<
p><
b>Table of Contents</
b></
p>
0N/A<
dt><
span class="sect1"><
a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</
a></
span></
dt>
0N/A<
dt><
span class="sect1"><
a href="Bv9ARM.ch07.html#id2605733"><
span><
strong class="command">Chroot</
strong></
span> and <
span><
strong class="command">Setuid</
strong></
span></
a></
span></
dt>
0N/A<
dt><
span class="sect2"><
a href="Bv9ARM.ch07.html#id2605882">The <
span><
strong class="command">chroot</
strong></
span> Environment</
a></
span></
dt>
338N/A<
dt><
span class="sect2"><
a href="Bv9ARM.ch07.html#id2605942">Using the <
span><
strong class="command">setuid</
strong></
span> Function</
a></
span></
dt>
0N/A<
dt><
span class="sect1"><
a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</
a></
span></
dt>
0N/A<
div class="sect1" lang="en">
0N/A<
div class="titlepage"><
div><
div><
h2 class="title" style="clear: both">
0N/A<
a name="Access_Control_Lists"></
a>Access Control Lists</
h2></
div></
div></
div>
0N/A Access Control Lists (ACLs) are address match lists that
0N/A you can set up and nickname for future use in <
span><
strong class="command">allow-notify</
strong></
span>,
0N/A <
span><
strong class="command">allow-query</
strong></
span>, <
span><
strong class="command">allow-query-on</
strong></
span>,
1242N/A <
span><
strong class="command">allow-recursion</
strong></
span>, <
span><
strong class="command">allow-recursion-on</
strong></
span>,
1242N/A <
span><
strong class="command">blackhole</
strong></
span>, <
span><
strong class="command">allow-transfer</
strong></
span>,
0N/A Using ACLs allows you to have finer control over who can access
0N/A your name server, without cluttering up your config files with huge
0N/A lists of IP addresses.
0N/A It is a <
span class="emphasis"><
em>good idea</
em></
span> to use ACLs, and to
0N/A control access to your server. Limiting access to your server by
0N/A outside parties can help prevent spoofing and denial of service (DoS) attacks against
0N/A Here is an example of how to properly apply ACLs:
0N/A<
pre class="programlisting">
0N/A// Set up an ACL named "bogusnets" that will block
0N/A// RFC1918 space and some reserved space, which is
0N/A// commonly used in spoofing attacks.
0N/A// Set up an ACL called our-nets. Replace this with the
0N/A allow-query { our-nets; };
0N/A allow-recursion { our-nets; };
1242N/A This allows recursive queries of the server from the outside
0N/A unless recursion has been previously disabled.
1242N/A<
div class="sect1" lang="en">
0N/A<
div class="titlepage"><
div><
div><
h2 class="title" style="clear: both">
1242N/A<
a name="id2605733"></
a><
span><
strong class="command">Chroot</
strong></
span> and <
span><
strong class="command">Setuid</
strong></
span>
1242N/A On UNIX servers, it is possible to run <
acronym class="acronym">BIND</
acronym>
0N/A in a <
span class="emphasis"><
em>chrooted</
em></
span> environment (using
1242N/A the <
span><
strong class="command">chroot()</
strong></
span> function) by specifying
1242N/A the "<
code class="option">-t</
code>" option for <
span><
strong class="command">named</
strong></
span>.
0N/A This can help improve system security by placing
1242N/A <
acronym class="acronym">BIND</
acronym> in a "sandbox", which will limit
1242N/A the damage done if a server is compromised.
0N/A Another useful feature in the UNIX version of <
acronym class="acronym">BIND</
acronym> is the
0N/A ability to run the daemon as an unprivileged user ( <
code class="option">-u</
code> <
em class="replaceable"><
code>user</
code></
em> ).
0N/A We suggest running as an unprivileged user when using the <
span><
strong class="command">chroot</
strong></
span> feature.
0N/A Here is an example command line to load <
acronym class="acronym">BIND</
acronym> in a <
span><
strong class="command">chroot</
strong></
span> sandbox,
1242N/A <
span><
strong class="command">/
var/
named</
strong></
span>, and to run <
span><
strong class="command">named</
strong></
span> <
span><
strong class="command">setuid</
strong></
span> to
0N/A<
div class="sect2" lang="en">
1242N/A<
div class="titlepage"><
div><
div><
h3 class="title">
1242N/A<
a name="id2605882"></
a>The <
span><
strong class="command">chroot</
strong></
span> Environment</
h3></
div></
div></
div>
1242N/A In order for a <
span><
strong class="command">chroot</
strong></
span> environment
1242N/A work properly in a particular directory
1242N/A you will need to set up an environment that includes everything
1242N/A <
acronym class="acronym">BIND</
acronym> needs to run.
0N/A From <
acronym class="acronym">BIND</
acronym>'s point of view, <
code class="filename">/
var/
named</
code> is
1242N/A the root of the filesystem. You will need to adjust the values of
0N/A like <
span><
strong class="command">directory</
strong></
span> and <
span><
strong class="command">pid-file</
strong></
span> to account
1242N/A Unlike with earlier versions of BIND, you typically will
868N/A <
span class="emphasis"><
em>not</
em></
span> need to compile <
span><
strong class="command">named</
strong></
span>
0N/A statically nor install shared libraries under the new root.
0N/A However, depending on your operating system, you may need
0N/A<
div class="sect2" lang="en">
1242N/A<
div class="titlepage"><
div><
div><
h3 class="title">
1242N/A<
a name="id2605942"></
a>Using the <
span><
strong class="command">setuid</
strong></
span> Function</
h3></
div></
div></
div>
0N/A Prior to running the <
span><
strong class="command">named</
strong></
span> daemon,
1242N/A the <
span><
strong class="command">touch</
strong></
span> utility (to change file
1242N/A modification times) or the <
span><
strong class="command">chown</
strong></
span>
1242N/A to which you want <
acronym class="acronym">BIND</
acronym>
1242N/A<
div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
0N/A Note that if the <
span><
strong class="command">named</
strong></
span> daemon is running as an
1242N/A unprivileged user, it will not be able to bind to new restricted
1242N/A ports if the server is reloaded.
0N/A<
div class="sect1" lang="en">
1242N/A<
div class="titlepage"><
div><
div><
h2 class="title" style="clear: both">
0N/A<
a name="dynamic_update_security"></
a>Dynamic Update Security</
h2></
div></
div></
div>
0N/A update facility should be strictly limited. In earlier versions of
0N/A <
acronym class="acronym">BIND</
acronym>, the only way to do this was
1242N/A address of the host requesting the update, by listing an IP address
1242N/A network prefix in the <
span><
strong class="command">allow-update</
strong></
span>
1242N/A This method is insecure since the source address of the update UDP
1242N/A is easily forged. Also note that if the IP addresses allowed by the
1242N/A <
span><
strong class="command">allow-update</
strong></
span> option include the
1242N/A server which performs forwarding of dynamic updates, the master can
1242N/A trivially attacked by sending the update to the slave, which will
1242N/A forward it to the master with its own source IP address causing the
1242N/A master to approve it without question.
1242N/A For these reasons, we strongly recommend that updates be
0N/A cryptographically authenticated by means of transaction signatures
0N/A (TSIG). That is, the <
span><
strong class="command">allow-update</
strong></
span>
0N/A list only TSIG key names, not IP addresses or network
1242N/A prefixes. Alternatively, the new <
span><
strong class="command">update-policy</
strong></
span>
1242N/A Some sites choose to keep all dynamically-updated DNS data
0N/A in a subdomain and delegate that subdomain to a separate zone. This
0N/A way, the top-level zone containing critical data such as the IP
0N/A of public web and mail servers need not allow dynamic update at
1242N/A<
table width="100%" summary="Navigation footer">
1242N/A<
td width="40%" align="left">
0N/A<
td width="20%" align="center">�</
td>
1242N/A<
td width="40%" align="left" valign="top">Chapter�6.�<
acronym class="acronym">BIND</
acronym> 9 Configuration Reference�</
td>
0N/A<
td width="20%" align="center"><
a accesskey="h" href="Bv9ARM.html">Home</
a></
td>
0N/A<
td width="40%" align="right" valign="top">�Chapter�8.�Troubleshooting</
td>