Bv9ARM.ch07.html revision b414eb4312cd9d40f40399539ccaa2a9e48e40a3
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic>BIND 9 Security Considerations</TITLE
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavicNAME="GENERATOR"
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavicCONTENT="Modular DocBook HTML Stylesheet Version 1.61
4da61833a1cbbca94094f9653fd970582b97a72etrawickTITLE="BIND 9 Administrator Reference Manual"
4da61833a1cbbca94094f9653fd970582b97a72etrawickREL="PREVIOUS"
4789804be088bcd86ae637a29cdb7fda25169521jailletcTITLE="BIND 9 Configuration Reference"
4789804be088bcd86ae637a29cdb7fda25169521jailletcTITLE="Troubleshooting"
e50c3026198fd496f183cda4c32a202925476778covenerCLASS="chapter"
5b88c8507d5ef6d0c4cfbc78230294968175b638minfrinBGCOLOR="#FFFFFF"
5b88c8507d5ef6d0c4cfbc78230294968175b638minfrinTEXT="#000000"
6c3b9cebb551140fbb25d58bae08b539b3802133ylavicLINK="#0000FF"
6c3b9cebb551140fbb25d58bae08b539b3802133ylavicVLINK="#840084"
6c3b9cebb551140fbb25d58bae08b539b3802133ylavicALINK="#0000FF"
4f29b65ab4b547ad5dbe506e2d0ff5d12ead9247ylavicCLASS="NAVHEADER"
0a0df13b7f1f4f1a74fe295253d89ca3911b301aylavicWIDTH="100%"
0a0df13b7f1f4f1a74fe295253d89ca3911b301aylavicCELLPADDING="0"
69301145375a889e7e37caf7cc7321ac0f91801erpluemCELLSPACING="0"
506bfe33206b2fece40ef25f695af39dd4130facjkaluzaALIGN="center"
506bfe33206b2fece40ef25f695af39dd4130facjkaluza>BIND 9 Administrator Reference Manual</TH
2e6f4d654c96c98b761fb012fd25c5d5b1558c44sfALIGN="left"
2e6f4d654c96c98b761fb012fd25c5d5b1558c44sfVALIGN="bottom"
e8bd80a4bb88199d2f9a24a50345688e52d9c116ylavicALIGN="center"
e8bd80a4bb88199d2f9a24a50345688e52d9c116ylavicVALIGN="bottom"
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavicALIGN="right"
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavicVALIGN="bottom"
d7205b1a86c51c27b71a2c458dc453fd53a261c1covenerALIGN="LEFT"
44ff304057225e944e220e981d434a046d14cf06covenerCLASS="chapter"
5d1ba75b8794925e67591c209085a49279791de9covener>Chapter 7. <SPAN
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrandCLASS="acronym"
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrand> 9 Security Considerations</A
f7317ff316c2b141feea31bddb74d5d3fa1584edjorton>Table of Contents</B
a34684a59b60a4173c25035d0c627ef17e6dc215rpluemHREF="Bv9ARM.ch07.html#Access_Control_Lists"
1e2d421a36999d292042a5539971070d54aa6c63ylavic>Access Control Lists</A
0b67eb8568cd58bb77082703951679b42cf098actrawickCLASS="command"
0b67eb8568cd58bb77082703951679b42cf098actrawickCLASS="command"
09c87c777bed1655621bb20e1c46cb6b1a63279dcovenerUNIX servers)</A
c1a63b8fad09c419c1a64f75993feb8a343a6801ylavicHREF="Bv9ARM.ch07.html#dynamic_update_security"
c1a63b8fad09c419c1a64f75993feb8a343a6801ylavic>Dynamic Update Security</A
e466c40e1801982602ee0200c9e8b61cc148742djailletcCLASS="sect1"
457468b82e59d01eba00dd9d0817309c8f5e414ejimCLASS="sect1"
04983e3bd1754764eec7d6bb772fe3b0bf391771jortonNAME="Access_Control_Lists"
04983e3bd1754764eec7d6bb772fe3b0bf391771jorton>7.1. Access Control Lists</A
15660979a30d251681463de2e0584853890082accovener>Access Control Lists (ACLs), are address match lists that
49dacedb6c387b786b7911082ff35121a45f414bcoveneryou can set up and nickname for future use in <B
49dacedb6c387b786b7911082ff35121a45f414bcovenerCLASS="command"
cfd9415521847b2f9394fad04fb701cfb955f503rjung>allow-notify</B
28c31fb73c1264bd1d0ff932573677030b024c7dwroweCLASS="command"
28c31fb73c1264bd1d0ff932573677030b024c7dwrowe>allow-query</B
28c31fb73c1264bd1d0ff932573677030b024c7dwroweCLASS="command"
28c31fb73c1264bd1d0ff932573677030b024c7dwrowe>allow-recursion</B
63b9f1f5880391261705f696d7d65507bbe9ace3covenerCLASS="command"
63b9f1f5880391261705f696d7d65507bbe9ace3covener>blackhole</B
49dacedb6c387b786b7911082ff35121a45f414bcovenerCLASS="command"
49dacedb6c387b786b7911082ff35121a45f414bcovener>allow-transfer</B
3c990331fc6702119e4f5b8ba9eae3021aea5265jim>Using ACLs allows you to have finer control over who can access
3c990331fc6702119e4f5b8ba9eae3021aea5265jimyour name server, without cluttering up your config files with huge
fc42512879dd0504532f52fe5d0d0383dda96a1eniqlists of IP addresses.</P
fc42512879dd0504532f52fe5d0d0383dda96a1eniq>It is a <I
0451df5dc50fa5d8b3e07d92ee6a92e36a1181a5niqCLASS="emphasis"
0451df5dc50fa5d8b3e07d92ee6a92e36a1181a5niq>good idea</I
0451df5dc50fa5d8b3e07d92ee6a92e36a1181a5niq> to use ACLs, and to
da0442c0440caef34706e2c2f3af05cb65921cc0jailletccontrol access to your server. Limiting access to your server by
983528026996668ea295be95aedb9c7a346af470ylavicoutside parties can help prevent spoofing and DoS attacks against
da0442c0440caef34706e2c2f3af05cb65921cc0jailletcyour server.</P
06b8f183140c8e02e0974e938a05078b511d1603covener>Here is an example of how to properly apply ACLs:</P
06b8f183140c8e02e0974e938a05078b511d1603covenerCLASS="programlisting"
15890c9306ba98f6fc243e15a3c4778ddc7d773erpluem> // Set up an ACL named "bogusnets" that will block RFC1918 space,
259878293a997ff49f5ddfc53d3739cbdc25444ecovener// which is commonly used in spoofing attacks.
259878293a997ff49f5ddfc53d3739cbdc25444ecoveneracl bogusnets { 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3; 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; };
259878293a997ff49f5ddfc53d3739cbdc25444ecovener// Set up an ACL called our-nets. Replace this with the real IP numbers.
b54b024c06a19926832d77d40ba35ad8c41e4d3dminfrin allow-query { our-nets; };
65967d05f839dbf27cf91d91fa79585eeae19660minfrin allow-recursion { our-nets; };
65967d05f839dbf27cf91d91fa79585eeae19660minfrin blackhole { bogusnets; };
8152945ae46857b170cb227e79bb799f4fc7710dminfrin type master;
75f5c2db254c0167a0e396254460de09b775d203trawick allow-query { any; };
4f0358189bfa57b8e75bd6b94db264302a8f336amrumph>This allows recursive queries of the server from the outside
4f0358189bfa57b8e75bd6b94db264302a8f336amrumphunless recursion has been previously disabled.</P
5716f9c6daa92dde5f2f9d11ed63f7c9549c223atrawick>For more information on how to use ACLs to protect your server,
5716f9c6daa92dde5f2f9d11ed63f7c9549c223atrawickCLASS="emphasis"
54d750a84a175d8e338880514d440773eb986b50covener> advisory at
54d750a84a175d8e338880514d440773eb986b50covenerHREF="ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos"
54d750a84a175d8e338880514d440773eb986b50covenerTARGET="_top"
54d750a84a175d8e338880514d440773eb986b50covener>ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos</A
54d750a84a175d8e338880514d440773eb986b50covenerCLASS="sect1"
83b50288fa7d306324bba68832011ea08f5c7832covenerCLASS="sect1"
83b50288fa7d306324bba68832011ea08f5c7832covenerNAME="AEN4263"
5f066f496cd9f20a2a701255bc67d44e7cb46daetrawickCLASS="command"
2e15620d724fb8e3a5be183b917359a2fd6e9468covenerCLASS="command"
1b988c41ee505962781d110a3e4c2c90f1ea0aa4covenerUNIX servers)</A
1b988c41ee505962781d110a3e4c2c90f1ea0aa4covener>On UNIX servers, it is possible to run <SPAN
b8efdc95bec9cf089aa1be0bfd07d46aa1137a7acovenerCLASS="acronym"
f06e7c4b1bce6b6491e5de0b7998d3f5696b293dchrisdCLASS="emphasis"
f06e7c4b1bce6b6491e5de0b7998d3f5696b293dchrisd>chrooted</I
f06e7c4b1bce6b6491e5de0b7998d3f5696b293dchrisd> environment
179565be4043d7e5f9161aa75271fa0a001866d9covenerCLASS="command"
179565be4043d7e5f9161aa75271fa0a001866d9covener>chroot()</B
111436a32ba1254291e4883292fb116d15fe8f64covener>) by specifying the "<TT
fce4949fb0b309a5744afcd503c6ed2d35621ee2covenerCLASS="option"
fce4949fb0b309a5744afcd503c6ed2d35621ee2coveneroption. This can help improve system security by placing <SPAN
7b7430e701e9a31ce809da7c220bb8dfcf68c86etrawickCLASS="acronym"
ccc20788c1e5fc973f36df634399c89acb70deaejerenkrantza "sandbox", which will limit the damage done if a server is compromised.</P
ccc20788c1e5fc973f36df634399c89acb70deaejerenkrantz>Another useful feature in the UNIX version of <SPAN
273e512f20f262e5e2aa8e0e83371d1929fb76adjkaluzaCLASS="acronym"
efe780dcf13b2b95effabf897d694d8f23feac74trawickability to run the daemon as an unprivileged user ( <TT
fe83f60b41477b14a37edcfcd1f7f5c5a1ebfe44minfrinCLASS="option"
993d1261a278d7322bccef219101220b7b4fb8c5jkaluzaCLASS="replaceable"
ba050a6f942b9fa0e81ed73437588005c569655ccovenerWe suggest running as an unprivileged user when using the <B
ba050a6f942b9fa0e81ed73437588005c569655ccovenerCLASS="command"
135ddda3a989215d2bedbcf1529bfb269c3eda23niq> feature.</P
001a44c352f89c9ec332ffd3e0a6927dcd19432chumbedooh>Here is an example command line to load <SPAN
001a44c352f89c9ec332ffd3e0a6927dcd19432chumbedoohCLASS="acronym"
793214f67dede32edfd9ee96c664ead04d175cbbjfclereCLASS="command"
cc5a4a08dc9783fcbc52ce86f11e01c281a43810minfrin>chroot()</B
9b0076ddd1103e5fa9c1f9bafde4b06ce244fbaecovenerCLASS="command"
249d09d51808cb7981af99762c3b3736ca126cd5jkaluza>, and to run <B
249d09d51808cb7981af99762c3b3736ca126cd5jkaluzaCLASS="command"
56589be3d7a3e9343370df240010c6928cc78b39jkaluzaCLASS="command"
77ca16c5676da23155311e13cee61e7eaba9fa3ejailletcuser 202:</P
f87299dab99bc04b51a6b8cad51b6795db862c0atrawickCLASS="userinput"
85eacfc96a04547ef25aabbc06440039715084c2jortonCLASS="sect2"
e5d909f2b06bd880fb3675cd49363df981caa631trawickCLASS="sect2"
a4df2cd1e1391575a327c2a90ba4315f805a0a78covenerNAME="AEN4286"
a4df2cd1e1391575a327c2a90ba4315f805a0a78covener>7.2.1. The <B
cb666b29f81df1d11d65002250153353568021fccovenerCLASS="command"
cb666b29f81df1d11d65002250153353568021fccovener> Environment</A
6a80c3c6f4b8ea7ba5e89402b8b779b09ce020e0covener>In order for a <B
75a230a728338d84dcfe81edd375352f34de22d0covenerCLASS="command"
75a230a728338d84dcfe81edd375352f34de22d0covener>chroot()</B
75a230a728338d84dcfe81edd375352f34de22d0covener> environment to
1f50dc34ae069adeed20b2986e5ffdefa5c410e0covenerwork properly in a particular directory
1f50dc34ae069adeed20b2986e5ffdefa5c410e0covener(for example, <TT
1f50dc34ae069adeed20b2986e5ffdefa5c410e0covenerCLASS="filename"
63a5ea80bddcc84a462e40f402b4f330e0e05411coveneryou will need to set up an environment that includes everything
65a4e663b82f8bce28ac22ab2edfd7502de36998sfCLASS="acronym"
65a4e663b82f8bce28ac22ab2edfd7502de36998sf>BIND</SPAN
65a4e663b82f8bce28ac22ab2edfd7502de36998sf> needs to run.
c7de1955eb0eaeabf7042902476397692672d549sfCLASS="acronym"
74e7f6c55fd67b10cb400b3f6d1dc718a303d944minfrin>'s point of view, <TT
74e7f6c55fd67b10cb400b3f6d1dc718a303d944minfrinCLASS="filename"
a511a29faf2ff7ead3b67680154a624effb31aafminfrinthe root of the filesystem. You will need to adjust the values of options like
a511a29faf2ff7ead3b67680154a624effb31aafminfrinCLASS="command"
a511a29faf2ff7ead3b67680154a624effb31aafminfrin>directory</B
63921358ef93fcb41bc71d9894221ba3d7fbb87bminfrinCLASS="command"
63921358ef93fcb41bc71d9894221ba3d7fbb87bminfrin>pid-file</B
deec48c67d4786bc77112ffbf3a4e70b931097edminfrin> to account
6d601599d3d65df0410eae6e573e75b2dbfb1fb4minfrin> Unlike with earlier versions of BIND, you will typically
684e0cfc200f66287a93bbd1708d1dd8a92a7eefcovenerCLASS="emphasis"
05a5a9c3e16f21566e1b61f4bd68025ce1b741ccjoes> need to compile <B
05a5a9c3e16f21566e1b61f4bd68025ce1b741ccjoesCLASS="command"
ef82e8fa164e0a1f8b813f7deb6b7ead96018c94niqstatically nor install shared libraries under the new root.
ef82e8fa164e0a1f8b813f7deb6b7ead96018c94niqHowever, depending on your operating system, you may need
ef82e8fa164e0a1f8b813f7deb6b7ead96018c94niqto set up things like
ef82e8fa164e0a1f8b813f7deb6b7ead96018c94niqCLASS="filename"
c12917da693bae4028a1d5a5e8224bceed8c739dsfCLASS="filename"
eafcc0ebf263d0ba69855b6e10958c4c1a2361bdsfCLASS="filename"
d7ffd2da16d58b1a0de212e4d56f7aebb72bef26sfCLASS="filename"
9811aed12bbc71783d2e544ccb5fecd193843eadsfCLASS="sect2"
88fac54d9d64f85bbdab5d7010816f4377f95bd7rjungCLASS="sect2"
bd3f5647b96d378d9c75c954e3f13582af32c643sfNAME="AEN4304"
bd3f5647b96d378d9c75c954e3f13582af32c643sf>7.2.2. Using the <B
bd3f5647b96d378d9c75c954e3f13582af32c643sfCLASS="command"
2a7beea91d46beb41f043a84eaad060047ee04aafabien> Function</A
2a7beea91d46beb41f043a84eaad060047ee04aafabien>Prior to running the <B
584a85dd4047e38d3ed3a29b6662fcc9d100ae4csfCLASS="command"
584a85dd4047e38d3ed3a29b6662fcc9d100ae4csf> daemon, use
f21e9e3d0bfb7a507ecc5bc963f2159d693503d1sfCLASS="command"
f6b9c755a0b793e8a3a3aebd327ca20a86478117sf> utility (to change file access and
f6b9c755a0b793e8a3a3aebd327ca20a86478117sfmodification times) or the <B
f6b9c755a0b793e8a3a3aebd327ca20a86478117sfCLASS="command"
132ee6ac1c26d6e8953836316ba50734eefab47bsf> utility (to
85eacfc96a04547ef25aabbc06440039715084c2jortonto which you want <SPAN
85eacfc96a04547ef25aabbc06440039715084c2jortonCLASS="acronym"
536d2e7cd1fdec1255b8c3bdf41fdc714c506a54trawickto write. Note that if the <B
536d2e7cd1fdec1255b8c3bdf41fdc714c506a54trawickCLASS="command"
79c5787b92ac5f0e1cc82393816c77a006399316trawick> daemon is running as an
79c5787b92ac5f0e1cc82393816c77a006399316trawickunprivileged user, it will not be able to bind to new restricted ports if the
79c5787b92ac5f0e1cc82393816c77a006399316trawickserver is reloaded.</P
79c5787b92ac5f0e1cc82393816c77a006399316trawickCLASS="sect1"
79c5787b92ac5f0e1cc82393816c77a006399316trawickCLASS="sect1"
7b395e4e878c28a4784919cfd2e704ddd14a3390jortonNAME="dynamic_update_security"
7b395e4e878c28a4784919cfd2e704ddd14a3390jorton>7.3. Dynamic Update Security</A
536e48c08d674acac5d44929318f2ad928edc361jorton>Access to the dynamic
536e48c08d674acac5d44929318f2ad928edc361jortonupdate facility should be strictly limited. In earlier versions of
e81785da447b469da66f218b3f0244aab507958djortonCLASS="acronym"
3e4e54d4e3fc0123c63d57aa84ac7ad7a8c73ff8jorton> the only way to do this was based on the IP
3e4e54d4e3fc0123c63d57aa84ac7ad7a8c73ff8jortonaddress of the host requesting the update, by listing an IP address or
53e9b27aba029b18be814df40bcf6f0428771d1efuankgnetwork prefix in the <B
53e9b27aba029b18be814df40bcf6f0428771d1efuankgCLASS="command"
53e9b27aba029b18be814df40bcf6f0428771d1efuankg>allow-update</B
53e9b27aba029b18be814df40bcf6f0428771d1efuankg> zone option.
53e9b27aba029b18be814df40bcf6f0428771d1efuankgThis method is insecure since the source address of the update UDP packet
6bb524f1895f30265a1431afc460977d391cb36bsfis easily forged. Also note that if the IP addresses allowed by the
ca61ccd0c306c2c72df153688ba1b49f3eceed80sfCLASS="command"
6bb524f1895f30265a1431afc460977d391cb36bsf>allow-update</B
e6dd71992459d05a676b98b7963423dc5dc1e24aminfrin> option include the address of a slave
e6dd71992459d05a676b98b7963423dc5dc1e24aminfrinserver which performs forwarding of dynamic updates, the master can be
e6dd71992459d05a676b98b7963423dc5dc1e24aminfrintrivially attacked by sending the update to the slave, which will
e6dd71992459d05a676b98b7963423dc5dc1e24aminfrinforward it to the master with its own source IP address causing the
23f1535d6a60817d2846bac0aea230ea475d7dccminfrinmaster to approve it without question.</P
23f1535d6a60817d2846bac0aea230ea475d7dccminfrin>For these reasons, we strongly recommend that updates be
23f1535d6a60817d2846bac0aea230ea475d7dccminfrincryptographically authenticated by means of transaction signatures
ec7520b24cd80d34d82bbcaca153cbb23cc04bc0rjung(TSIG). That is, the <B
ec7520b24cd80d34d82bbcaca153cbb23cc04bc0rjungCLASS="command"
ec7520b24cd80d34d82bbcaca153cbb23cc04bc0rjung>allow-update</B
ec7520b24cd80d34d82bbcaca153cbb23cc04bc0rjung> option should
ec7520b24cd80d34d82bbcaca153cbb23cc04bc0rjunglist only TSIG key names, not IP addresses or network
ec7520b24cd80d34d82bbcaca153cbb23cc04bc0rjungprefixes. Alternatively, the new <B
ec7520b24cd80d34d82bbcaca153cbb23cc04bc0rjungCLASS="command"
ec7520b24cd80d34d82bbcaca153cbb23cc04bc0rjung>update-policy</B
6249dfa569d3b4f1f539665b979a80c6e335d93etrawickoption can be used.</P
6249dfa569d3b4f1f539665b979a80c6e335d93etrawick>Some sites choose to keep all dynamically updated DNS data
ae600ca541efc686b34f8b1f21bd3d0741d37674covenerin a subdomain and delegate that subdomain to a separate zone. This
6249dfa569d3b4f1f539665b979a80c6e335d93etrawickway, the top-level zone containing critical data such as the IP addresses
cfa64348224b66dd1c9979b809406c4d15b1c137fieldingof public web and mail servers need not allow dynamic update at
74499a117b3b2cd9666715a14f90c0e5d1a4ee8ajimCLASS="NAVFOOTER"
74499a117b3b2cd9666715a14f90c0e5d1a4ee8ajimALIGN="LEFT"
HREF="Bv9ARM.ch06.html"
HREF="Bv9ARM.html"
HREF="Bv9ARM.ch08.html"