Bv9ARM.ch07.html revision b346807a324803592624d0ce5af40de6b5549042
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND 9 Security Considerations</TITLE
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox UserNAME="GENERATOR"
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox UserCONTENT="Modular DocBook HTML Stylesheet Version 1.73
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinTITLE="BIND 9 Administrator Reference Manual"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinREL="PREVIOUS"
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox UserTITLE="BIND 9 Configuration Reference"
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox UserTITLE="Troubleshooting"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCLASS="chapter"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserBGCOLOR="#FFFFFF"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserTEXT="#000000"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserLINK="#0000FF"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserVLINK="#840084"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserALINK="#0000FF"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCLASS="NAVHEADER"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserSUMMARY="Header navigation table"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCELLPADDING="0"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCELLSPACING="0"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserALIGN="center"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND 9 Administrator Reference Manual</TH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinVALIGN="bottom"
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox UserALIGN="center"
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark AndrewsVALIGN="bottom"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinALIGN="right"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinVALIGN="bottom"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinACCESSKEY="N"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="chapter"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>Chapter 7. <SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="acronym"
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User> 9 Security Considerations</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>Table of Contents</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinHREF="Bv9ARM.ch07.html#Access_Control_Lists"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>Access Control Lists</A
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserUNIX servers)</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinHREF="Bv9ARM.ch07.html#dynamic_update_security"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>Dynamic Update Security</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect1"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect1"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinNAME="Access_Control_Lists"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>7.1. Access Control Lists</A
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>Access Control Lists (ACLs), are address match lists that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinyou can set up and nickname for future use in <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>allow-notify</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>allow-query</B
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCLASS="command"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>allow-recursion</B
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>allow-transfer</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>Using ACLs allows you to have finer control over who can access
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinyour name server, without cluttering up your config files with huge
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinlists of IP addresses.</P
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>It is a <SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>good idea</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> to use ACLs, and to
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Usercontrol access to your server. Limiting access to your server by
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Useroutside parties can help prevent spoofing and DoS attacks against
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox Useryour server.</P
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User>Here is an example of how to properly apply ACLs:</P
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox UserCLASS="programlisting"
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User> // Set up an ACL named "bogusnets" that will block RFC1918 space,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User// which is commonly used in spoofing attacks.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox Useracl bogusnets { 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3; 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; };
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein// Set up an ACL called our-nets. Replace this with the real IP numbers.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User allow-query { our-nets; };
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein allow-recursion { our-nets; };
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein blackhole { bogusnets; };
zone "example.com" {
HREF="Bv9ARM.ch06.html"
HREF="Bv9ARM.html"
HREF="Bv9ARM.ch08.html"