Bv9ARM.ch07.html revision b5e4e4da43461f416b19d52ec047495e6960579d
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User>BIND 9 Security Considerations</TITLE
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox UserNAME="GENERATOR"
c57668a2fbbe558c1bd21652813616f2f517c469Tinderbox UserCONTENT="Modular DocBook HTML Stylesheet Version 1.73
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark AndrewsTITLE="BIND 9 Administrator Reference Manual"
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox UserREL="PREVIOUS"
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox UserTITLE="BIND 9 Configuration Reference"
e676a596869d8a80a644c99a848afb53d1c5975eMark AndrewsTITLE="Troubleshooting"
a7c412f37cc73d0332887a746e81220cbf09dd00Mark AndrewsCLASS="chapter"
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark AndrewsBGCOLOR="#FFFFFF"
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark AndrewsTEXT="#000000"
e676a596869d8a80a644c99a848afb53d1c5975eMark AndrewsLINK="#0000FF"
e676a596869d8a80a644c99a848afb53d1c5975eMark AndrewsVLINK="#840084"
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark AndrewsALINK="#0000FF"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="NAVHEADER"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsSUMMARY="Header navigation table"
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox UserCELLPADDING="0"
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark AndrewsCELLSPACING="0"
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox UserALIGN="center"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews>BIND 9 Administrator Reference Manual</TH
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark AndrewsVALIGN="bottom"
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan HuntALIGN="center"
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox UserVALIGN="bottom"
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic UpdaterVALIGN="bottom"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="chapter"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews>Chapter 7. <SPAN
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="acronym"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews> 9 Security Considerations</A
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt>Table of Contents</B
2ae159b376dac23870d8005563c585acf85a4b5aEvan HuntHREF="Bv9ARM.ch07.html#Access_Control_Lists"
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User>Access Control Lists</A
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox UserCLASS="command"
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox UserCLASS="command"
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark AndrewsUNIX servers)</A
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox UserHREF="Bv9ARM.ch07.html#dynamic_update_security"
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson>Dynamic Update Security</A
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="sect1"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsNAME="Access_Control_Lists"
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User>7.1. Access Control Lists</A
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews>Access Control Lists (ACLs), are address match lists that
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox Useryou can set up and nickname for future use in <B
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="command"
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User>allow-notify</B
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="command"
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User>allow-query</B
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark AndrewsCLASS="command"
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews>allow-recursion</B
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox UserCLASS="command"
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews>blackhole</B
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox UserCLASS="command"
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User>allow-transfer</B
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews>Using ACLs allows you to have finer control over who can access
2a31bd531072824ef252c18303859d6af7451b00Francis Dupontyour name server, without cluttering up your config files with huge
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrewslists of IP addresses.</P
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews>It is a <SPAN
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark AndrewsCLASS="emphasis"
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark AndrewsCLASS="emphasis"
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews>good idea</I
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews> to use ACLs, and to
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrewscontrol access to your server. Limiting access to your server by
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrewsoutside parties can help prevent spoofing and DoS attacks against
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrewsyour server.</P
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User>Here is an example of how to properly apply ACLs:</P
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark AndrewsCLASS="programlisting"
e20788e1216ed720aefa84f3295f7899d9f28c22Mark Andrews> // Set up an ACL named "bogusnets" that will block RFC1918 space,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews// which is commonly used in spoofing attacks.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrewsacl bogusnets { 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3; 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; };
01a5c5503482fb3ba52088bf0178a7213273bf96Mark Andrews// Set up an ACL called our-nets. Replace this with the real IP numbers.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews allow-query { our-nets; };
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User allow-recursion { our-nets; };
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User blackhole { bogusnets; };
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User allow-query { any; };
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User>This allows recursive queries of the server from the outside
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrewsunless recursion has been previously disabled.</P
fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater>For more information on how to use ACLs to protect your server,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="emphasis"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="emphasis"
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox UserHREF="ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsTARGET="_top"
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User>ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos</A
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox UserNAME="AEN4675"
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox UserCLASS="command"
91216cff91b34c9ff6e846dc23f248219cafe660Andreas GustafssonCLASS="command"
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox UserUNIX servers)</A
5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User>On UNIX servers, it is possible to run <SPAN
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox UserCLASS="acronym"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="emphasis"
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark AndrewsCLASS="emphasis"
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox UserCLASS="command"
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User>) by specifying the "<TT
a7c412f37cc73d0332887a746e81220cbf09dd00Mark AndrewsCLASS="option"
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updateroption. This can help improve system security by placing <SPAN
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic UpdaterCLASS="acronym"
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox Usera "sandbox", which will limit the damage done if a server is compromised.</P
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews>Another useful feature in the UNIX version of <SPAN
91d187ce035f39073f0732ff2a401a45c3c955fbMark AndrewsCLASS="acronym"
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updaterability to run the daemon as an unprivileged user ( <TT
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic UpdaterCLASS="replaceable"
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox UserWe suggest running as an unprivileged user when using the <B
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic UpdaterCLASS="command"
7f94d9a8162c9a96b56e66176702b66e79d8e1a2Automatic Updater>Here is an example command line to load <SPAN
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic UpdaterCLASS="acronym"
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox UserCLASS="command"
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox UserCLASS="command"
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater>, and to run <B
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic UpdaterCLASS="command"
4cda4fd158d6ded5586bacea8c388445d99611eaAutomatic UpdaterCLASS="command"
4fe0411487e8e4401477684c0a2bac041ca7c2d5Tinderbox UserCLASS="userinput"
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark AndrewsCLASS="sect2"
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews>7.2.1. The <B
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark AndrewsCLASS="command"
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User> Environment</A
6025cbbe8408f4b09d53d5ec1e95cb6da97e0a8dTinderbox User>In order for a <B
e676a596869d8a80a644c99a848afb53d1c5975eMark AndrewsCLASS="command"
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater> environment to
cf7e98f59148b559946a7f1ca728471374f1eef3Automatic Updaterwork properly in a particular directory
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews(for example, <TT
91216cff91b34c9ff6e846dc23f248219cafe660Andreas GustafssonCLASS="filename"
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrewsyou will need to set up an environment that includes everything
757ff043760e4743dda1a10e7d58349275934902Tinderbox UserCLASS="acronym"
4fe0411487e8e4401477684c0a2bac041ca7c2d5Tinderbox User> needs to run.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox UserCLASS="acronym"
3857cb6fcabeb79d85de4b3e3e4ab99912b701f8Mark Andrews>'s point of view, <TT
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox UserCLASS="filename"
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox Userthe root of the filesystem. You will need to adjust the values of options like
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox UserCLASS="command"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews>directory</B
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="command"
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews> Unlike with earlier versions of BIND, you will typically
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark AndrewsCLASS="emphasis"
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark AndrewsCLASS="emphasis"
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews> need to compile <B
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark AndrewsCLASS="command"
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrewsstatically nor install shared libraries under the new root.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark AndrewsHowever, depending on your operating system, you may need
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrewsto set up things like
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark AndrewsCLASS="filename"
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark AndrewsCLASS="filename"
e8fc8c884b44371784805e1e0d3100da403dd3f1Automatic UpdaterCLASS="filename"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="filename"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="sect2"
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark AndrewsCLASS="sect2"
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark AndrewsNAME="AEN4716"
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews>7.2.2. Using the <B
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark AndrewsCLASS="command"
01a5c5503482fb3ba52088bf0178a7213273bf96Mark Andrews>Prior to running the <B
95c3a5e116c1da135f669c3f15398172fac6279dMark AndrewsCLASS="command"
d585233c52e283d9a8849f16f04f452419a2484eTinderbox UserCLASS="command"
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews> utility (to change file access and
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updatermodification times) or the <B
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark AndrewsCLASS="command"
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox Userto which you want <SPAN
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark AndrewsCLASS="acronym"
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updaterto write. Note that if the <B
7f79131f9a8e804b93c57f3c679065cce878b726Automatic UpdaterCLASS="command"
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson> daemon is running as an
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrewsunprivileged user, it will not be able to bind to new restricted ports if the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrewsserver is reloaded.</P
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark AndrewsCLASS="sect1"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="sect1"
3a988722ad9e209ba4064604d482dc4efe0e19ebTinderbox UserNAME="dynamic_update_security"
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington>7.3. Dynamic Update Security</A
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews>Access to the dynamic
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrewsupdate facility should be strictly limited. In earlier versions of
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="acronym"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews> the only way to do this was based on the IP
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrewsaddress of the host requesting the update, by listing an IP address or
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrewsnetwork prefix in the <B
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsCLASS="command"
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User>allow-update</B
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User> zone option.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsThis method is insecure since the source address of the update UDP packet
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrewsis easily forged. Also note that if the IP addresses allowed by the
a5636b773fa05a272b6876afd99309c0b3090e2fMark AndrewsCLASS="command"
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews>allow-update</B
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews> option include the address of a slave
f7369b2881b5e63d69600adcedc8ba938303d30cTinderbox Userserver which performs forwarding of dynamic updates, the master can be
f7369b2881b5e63d69600adcedc8ba938303d30cTinderbox Usertrivially attacked by sending the update to the slave, which will
d6317350b1180aa4517f2e8a92fa8fbcbf904ad8Automatic Updaterforward it to the master with its own source IP address causing the
bc0a4c01beede169df81a3ee5b614ed9e82339dbAutomatic Updatermaster to approve it without question.</P
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington>For these reasons, we strongly recommend that updates be
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellingtoncryptographically authenticated by means of transaction signatures
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington(TSIG). That is, the <B
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian WellingtonCLASS="command"
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington>allow-update</B
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington> option should
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellingtonlist only TSIG key names, not IP addresses or network
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellingtonprefixes. Alternatively, the new <B
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian WellingtonCLASS="command"
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington>update-policy</B
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellingtonoption can be used.</P
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington>Some sites choose to keep all dynamically updated DNS data
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellingtonin a subdomain and delegate that subdomain to a separate zone. This
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellingtonway, the top-level zone containing critical data such as the IP addresses
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellingtonof public web and mail servers need not allow dynamic update at
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian WellingtonCLASS="NAVFOOTER"
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian WellingtonSUMMARY="Footer navigation table"
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian WellingtonCELLPADDING="0"
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian WellingtonCELLSPACING="0"
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian WellingtonALIGN="center"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsALIGN="right"
0eb371ca0dab50ae3462e98794a6126198c52f4bMark AndrewsACCESSKEY="N"
ae7e54b14c946e0984c191554db9abb4893f9349Automatic UpdaterCLASS="acronym"
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater> 9 Configuration Reference</TD
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User>Troubleshooting</TD