Bv9ARM.ch07.html revision cbf7f1435f332b31f51a98611ccbfcd07c42c032
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos - Copyright (C) 2000-2003 Internet Software Consortium.
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos - Permission to use, copy, modify, and distribute this software for any
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos - purpose with or without fee is hereby granted, provided that the above
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos - copyright notice and this permission notice appear in all copies.
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos - PERFORMANCE OF THIS SOFTWARE.
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<!-- $Id: Bv9ARM.ch07.html,v 1.192 2009/03/24 01:12:40 tbox Exp $ -->
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<title>Chapter�7.�BIND 9 Security Considerations</title>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<link rel="prev" href="Bv9ARM.ch06.html" title="Chapter�6.�BIND 9 Configuration Reference">
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<link rel="next" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<table width="100%" summary="Navigation header">
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<tr><th colspan="3" align="center">Chapter�7.�<acronym class="acronym">BIND</acronym> 9 Security Considerations</th></tr>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<div class="titlepage"><div><div><h2 class="title">
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<a name="Bv9ARM.ch07"></a>Chapter�7.�<acronym class="acronym">BIND</acronym> 9 Security Considerations</h2></div></div></div>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2599317"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2599534">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2599594">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<div class="titlepage"><div><div><h2 class="title" style="clear: both">
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<a name="Access_Control_Lists"></a>Access Control Lists</h2></div></div></div>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos Access Control Lists (ACLs) are address match lists that
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos you can set up and nickname for future use in <span><strong class="command">allow-notify</strong></span>,
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos <span><strong class="command">allow-query</strong></span>, <span><strong class="command">allow-query-on</strong></span>,
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos <span><strong class="command">allow-recursion</strong></span>, <span><strong class="command">allow-recursion-on</strong></span>,
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos <span><strong class="command">blackhole</strong></span>, <span><strong class="command">allow-transfer</strong></span>,
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos Using ACLs allows you to have finer control over who can access
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos your name server, without cluttering up your config files with huge
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos lists of IP addresses.
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos It is a <span class="emphasis"><em>good idea</em></span> to use ACLs, and to
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos control access to your server. Limiting access to your server by
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos outside parties can help prevent spoofing and denial of service (DoS) attacks against
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos Here is an example of how to properly apply ACLs:
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos// Set up an ACL named "bogusnets" that will block RFC1918 space
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos// and some reserved space, which is commonly used in spoofing attacks.
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordosacl bogusnets {
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3;
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos// Set up an ACL called our-nets. Replace this with the real IP numbers.
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos allow-query { our-nets; };
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos allow-recursion { our-nets; };
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos blackhole { bogusnets; };
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos allow-query { any; };
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos This allows recursive queries of the server from the outside
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos unless recursion has been previously disabled.
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos For more information on how to use ACLs to protect your server,
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos see the <span class="emphasis"><em>AUSCERT</em></span> advisory at:
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos <a href="ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos" target="_top">ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos</a>
2fa3941d2c8e2d9c5b21d68695483ec6f140870cLaszlo Hordos<div class="titlepage"><div><div><h2 class="title" style="clear: both">
d90caa300251d7fd09e3f286018ce04356a71e62Laszlo Hordos<a name="id2599317"></a><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos On UNIX servers, it is possible to run <acronym class="acronym">BIND</acronym>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos in a <span class="emphasis"><em>chrooted</em></span> environment (using
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos the <span><strong class="command">chroot()</strong></span> function) by specifying
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos the "<code class="option">-t</code>" option for <span><strong class="command">named</strong></span>.
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos This can help improve system security by placing
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos <acronym class="acronym">BIND</acronym> in a "sandbox", which will limit
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos the damage done if a server is compromised.
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos Another useful feature in the UNIX version of <acronym class="acronym">BIND</acronym> is the
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos ability to run the daemon as an unprivileged user ( <code class="option">-u</code> <em class="replaceable"><code>user</code></em> ).
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos We suggest running as an unprivileged user when using the <span><strong class="command">chroot</strong></span> feature.
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos Here is an example command line to load <acronym class="acronym">BIND</acronym> in a <span><strong class="command">chroot</strong></span> sandbox,
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos <span><strong class="command">/var/named</strong></span>, and to run <span><strong class="command">named</strong></span> <span><strong class="command">setuid</strong></span> to
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos <strong class="userinput"><code>/usr/local/sbin/named -u 202 -t /var/named</code></strong>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<div class="titlepage"><div><div><h3 class="title">
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<a name="id2599534"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos In order for a <span><strong class="command">chroot</strong></span> environment
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos work properly in a particular directory
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos (for example, <code class="filename">/var/named</code>),
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos you will need to set up an environment that includes everything
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos <acronym class="acronym">BIND</acronym> needs to run.
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos From <acronym class="acronym">BIND</acronym>'s point of view, <code class="filename">/var/named</code> is
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos the root of the filesystem. You will need to adjust the values of
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos like <span><strong class="command">directory</strong></span> and <span><strong class="command">pid-file</strong></span> to account
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos Unlike with earlier versions of BIND, you typically will
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos <span class="emphasis"><em>not</em></span> need to compile <span><strong class="command">named</strong></span>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos statically nor install shared libraries under the new root.
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos However, depending on your operating system, you may need
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos to set up things like
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<div class="titlepage"><div><div><h3 class="title">
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<a name="id2599594"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos Prior to running the <span><strong class="command">named</strong></span> daemon,
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos the <span><strong class="command">touch</strong></span> utility (to change file
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos modification times) or the <span><strong class="command">chown</strong></span>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos to which you want <acronym class="acronym">BIND</acronym>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos Note that if the <span><strong class="command">named</strong></span> daemon is running as an
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos unprivileged user, it will not be able to bind to new restricted
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos ports if the server is reloaded.
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<div class="titlepage"><div><div><h2 class="title" style="clear: both">
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<a name="dynamic_update_security"></a>Dynamic Update Security</h2></div></div></div>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos Access to the dynamic
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos update facility should be strictly limited. In earlier versions of
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos <acronym class="acronym">BIND</acronym>, the only way to do this was
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos based on the IP
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos address of the host requesting the update, by listing an IP address
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos network prefix in the <span><strong class="command">allow-update</strong></span>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos This method is insecure since the source address of the update UDP
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos is easily forged. Also note that if the IP addresses allowed by the
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos <span><strong class="command">allow-update</strong></span> option include the
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos address of a slave
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos server which performs forwarding of dynamic updates, the master can
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos trivially attacked by sending the update to the slave, which will
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos forward it to the master with its own source IP address causing the
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos master to approve it without question.
b8dc46d8fabaf0050ef4847d103e66ea9395a032Laszlo Hordos For these reasons, we strongly recommend that updates be
b8dc46d8fabaf0050ef4847d103e66ea9395a032Laszlo Hordos cryptographically authenticated by means of transaction signatures
b8dc46d8fabaf0050ef4847d103e66ea9395a032Laszlo Hordos (TSIG). That is, the <span><strong class="command">allow-update</strong></span>
b8dc46d8fabaf0050ef4847d103e66ea9395a032Laszlo Hordos option should
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos list only TSIG key names, not IP addresses or network
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos prefixes. Alternatively, the new <span><strong class="command">update-policy</strong></span>
b8dc46d8fabaf0050ef4847d103e66ea9395a032Laszlo Hordos option can be used.
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos Some sites choose to keep all dynamically-updated DNS data
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos in a subdomain and delegate that subdomain to a separate zone. This
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos way, the top-level zone containing critical data such as the IP
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos of public web and mail servers need not allow dynamic update at
b8dc46d8fabaf0050ef4847d103e66ea9395a032Laszlo Hordos<table width="100%" summary="Navigation footer">
b8dc46d8fabaf0050ef4847d103e66ea9395a032Laszlo Hordos<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<td width="40%" align="left" valign="top">Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference�</td>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
0fdda69ce3627d501e4bb3103765f676bb1ab061Laszlo Hordos<td width="40%" align="right" valign="top">�Chapter�8.�Troubleshooting</td>