Bv9ARM.ch07.html revision cedb0bd0c1e3c461b7e479a16d3adfd5b150f1f4
8214510f125879c3b1d247f2ce981ee20b5375d1Jakub Hrozek - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
8214510f125879c3b1d247f2ce981ee20b5375d1Jakub Hrozek - Copyright (C) 2000-2003 Internet Software Consortium.
beeef7f627a5ed9264de25ee4c76eb9620c1c984Pavel Březina - Permission to use, copy, modify, and distribute this software for any
2fbe9b9373dcdc28558da07690e57ff7a162a11dJakub Hrozek - purpose with or without fee is hereby granted, provided that the above
8214510f125879c3b1d247f2ce981ee20b5375d1Jakub Hrozek - copyright notice and this permission notice appear in all copies.
dff909d473f43a6bd0f0286fa2d279c0ebe945c6Stef Walter - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
8214510f125879c3b1d247f2ce981ee20b5375d1Jakub Hrozek - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
2fbe9b9373dcdc28558da07690e57ff7a162a11dJakub Hrozek - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina - PERFORMANCE OF THIS SOFTWARE.
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina<!-- $Id: Bv9ARM.ch07.html,v 1.108 2005/10/13 03:14:04 marka Exp $ -->
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina<title>Chapter�7.�BIND 9 Security Considerations</title>
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina<link rel="prev" href="Bv9ARM.ch06.html" title="Chapter�6.�BIND 9 Configuration Reference">
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina<link rel="next" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina<table width="100%" summary="Navigation header">
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina<tr><th colspan="3" align="center">Chapter�7.�<span class="acronym">BIND</span> 9 Security Considerations</th></tr>
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
2fbe9b9373dcdc28558da07690e57ff7a162a11dJakub Hrozek<div class="titlepage"><div><div><h2 class="title">
2fbe9b9373dcdc28558da07690e57ff7a162a11dJakub Hrozek<a name="Bv9ARM.ch07"></a>Chapter�7.�<span class="acronym">BIND</span> 9 Security Considerations</h2></div></div></div>
3fe339bcba0e211cc666bb3afe34e5c8fce85f4fJakub Hrozek<dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt>
3fe339bcba0e211cc666bb3afe34e5c8fce85f4fJakub Hrozek<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2572720"><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span></a></span></dt>
3fe339bcba0e211cc666bb3afe34e5c8fce85f4fJakub Hrozek<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2572795">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
590582be38cdbfde387fcc57df92903d48c5a083Jakub Hrozek<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2572923">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
590582be38cdbfde387fcc57df92903d48c5a083Jakub Hrozek<dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt>
590582be38cdbfde387fcc57df92903d48c5a083Jakub Hrozek<div class="titlepage"><div><div><h2 class="title" style="clear: both">
590582be38cdbfde387fcc57df92903d48c5a083Jakub Hrozek<a name="Access_Control_Lists"></a>Access Control Lists</h2></div></div></div>
8214510f125879c3b1d247f2ce981ee20b5375d1Jakub Hrozek Access Control Lists (ACLs), are address match lists that
d387c4608dbd3ca056e18e85313ef51aac146fd2Pavel Březina you can set up and nickname for future use in <span><strong class="command">allow-notify</strong></span>,
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina <span><strong class="command">allow-query</strong></span>, <span><strong class="command">allow-recursion</strong></span>,
beeef7f627a5ed9264de25ee4c76eb9620c1c984Pavel Březina <span><strong class="command">blackhole</strong></span>, <span><strong class="command">allow-transfer</strong></span>,
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina Using ACLs allows you to have finer control over who can access
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina your name server, without cluttering up your config files with huge
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina lists of IP addresses.
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina It is a <span class="emphasis"><em>good idea</em></span> to use ACLs, and to
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina control access to your server. Limiting access to your server by
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina outside parties can help prevent spoofing and DoS attacks against
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina Here is an example of how to properly apply ACLs:
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina// Set up an ACL named "bogusnets" that will block RFC1918 space
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina// and some reserved space, which is commonly used in spoofing attacks.
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březinaacl bogusnets {
8a1fd0633e85221da1fb63451516a70d66c0af31Pavel Březina 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3;
d387c4608dbd3ca056e18e85313ef51aac146fd2Pavel Březina// Set up an ACL called our-nets. Replace this with the real IP numbers.
d387c4608dbd3ca056e18e85313ef51aac146fd2Pavel Březina allow-query { our-nets; };
d387c4608dbd3ca056e18e85313ef51aac146fd2Pavel Březina allow-recursion { our-nets; };
d387c4608dbd3ca056e18e85313ef51aac146fd2Pavel Březina blackhole { bogusnets; };
d387c4608dbd3ca056e18e85313ef51aac146fd2Pavel Březina allow-query { any; };
9e9ad4cb181c6c0ec70caacfb31319753f889e98Pavel Březina This allows recursive queries of the server from the outside
9e9ad4cb181c6c0ec70caacfb31319753f889e98Pavel Březina unless recursion has been previously disabled.
9e9ad4cb181c6c0ec70caacfb31319753f889e98Pavel Březina For more information on how to use ACLs to protect your server,
9e9ad4cb181c6c0ec70caacfb31319753f889e98Pavel Březina see the <span class="emphasis"><em>AUSCERT</em></span> advisory at:
9e9ad4cb181c6c0ec70caacfb31319753f889e98Pavel Březina <a href="ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos" target="_top">ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos</a>
d3c82d0170d6d7407549afdadd08aa7e11aeb9a2Pavel Březina<div class="titlepage"><div><div><h2 class="title" style="clear: both">
d3c82d0170d6d7407549afdadd08aa7e11aeb9a2Pavel Březina<a name="id2572720"></a><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span></h2></div></div></div>
d3c82d0170d6d7407549afdadd08aa7e11aeb9a2Pavel Březina On UNIX servers, it is possible to run <span class="acronym">BIND</span> in a <span class="emphasis"><em>chrooted</em></span> environment
d3c82d0170d6d7407549afdadd08aa7e11aeb9a2Pavel Březina (<span><strong class="command">chroot()</strong></span>) by specifying the "<code class="option">-t</code>"
d3c82d0170d6d7407549afdadd08aa7e11aeb9a2Pavel Březina option. This can help improve system security by placing <span class="acronym">BIND</span> in
d3c82d0170d6d7407549afdadd08aa7e11aeb9a2Pavel Březina a "sandbox", which will limit the damage done if a server is
d3c82d0170d6d7407549afdadd08aa7e11aeb9a2Pavel Březina Another useful feature in the UNIX version of <span class="acronym">BIND</span> is the
d3c82d0170d6d7407549afdadd08aa7e11aeb9a2Pavel Březina ability to run the daemon as an unprivileged user ( <code class="option">-u</code> <em class="replaceable"><code>user</code></em> ).
d3c82d0170d6d7407549afdadd08aa7e11aeb9a2Pavel Březina We suggest running as an unprivileged user when using the <span><strong class="command">chroot</strong></span> feature.
d3c82d0170d6d7407549afdadd08aa7e11aeb9a2Pavel Březina Here is an example command line to load <span class="acronym">BIND</span> in a <span><strong class="command">chroot()</strong></span> sandbox,
d3c82d0170d6d7407549afdadd08aa7e11aeb9a2Pavel Březina <span><strong class="command">/var/named</strong></span>, and to run <span><strong class="command">named</strong></span> <span><strong class="command">setuid</strong></span> to
d3c82d0170d6d7407549afdadd08aa7e11aeb9a2Pavel Březina <strong class="userinput"><code>/usr/local/bin/named -u 202 -t /var/named</code></strong>
c747b0c875785ce693f70b50bdda0237c4b04e35Pavel Březina<div class="titlepage"><div><div><h3 class="title">
c747b0c875785ce693f70b50bdda0237c4b04e35Pavel Březina<a name="id2572795"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div>
c747b0c875785ce693f70b50bdda0237c4b04e35Pavel Březina In order for a <span><strong class="command">chroot()</strong></span> environment
c747b0c875785ce693f70b50bdda0237c4b04e35Pavel Březina work properly in a particular directory
c747b0c875785ce693f70b50bdda0237c4b04e35Pavel Březina (for example, <code class="filename">/var/named</code>),
c747b0c875785ce693f70b50bdda0237c4b04e35Pavel Březina you will need to set up an environment that includes everything
c747b0c875785ce693f70b50bdda0237c4b04e35Pavel Březina <span class="acronym">BIND</span> needs to run.
c747b0c875785ce693f70b50bdda0237c4b04e35Pavel Březina From <span class="acronym">BIND</span>'s point of view, <code class="filename">/var/named</code> is
827a016a07d5f911cc4195be89896a376fd71f59Sumit Bose the root of the filesystem. You will need to adjust the values of
827a016a07d5f911cc4195be89896a376fd71f59Sumit Bose options like
827a016a07d5f911cc4195be89896a376fd71f59Sumit Bose like <span><strong class="command">directory</strong></span> and <span><strong class="command">pid-file</strong></span> to account
c747b0c875785ce693f70b50bdda0237c4b04e35Pavel Březina Unlike with earlier versions of BIND, you will typically
c747b0c875785ce693f70b50bdda0237c4b04e35Pavel Březina <span class="emphasis"><em>not</em></span> need to compile <span><strong class="command">named</strong></span>
c747b0c875785ce693f70b50bdda0237c4b04e35Pavel Březina statically nor install shared libraries under the new root.
c747b0c875785ce693f70b50bdda0237c4b04e35Pavel Březina However, depending on your operating system, you may need
c747b0c875785ce693f70b50bdda0237c4b04e35Pavel Březina to set up things like
c747b0c875785ce693f70b50bdda0237c4b04e35Pavel Březina <code class="filename">/dev/log</code>, and/or
a1e4113a5388e34c08459c5b69679c82ac2bddc9Pavel Březina<div class="titlepage"><div><div><h3 class="title">
a1e4113a5388e34c08459c5b69679c82ac2bddc9Pavel Březina<a name="id2572923"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div>
a1e4113a5388e34c08459c5b69679c82ac2bddc9Pavel Březina Prior to running the <span><strong class="command">named</strong></span> daemon,
a1e4113a5388e34c08459c5b69679c82ac2bddc9Pavel Březina the <span><strong class="command">touch</strong></span> utility (to change file
a1e4113a5388e34c08459c5b69679c82ac2bddc9Pavel Březina modification times) or the <span><strong class="command">chown</strong></span>
a1e4113a5388e34c08459c5b69679c82ac2bddc9Pavel Březina to which you want <span class="acronym">BIND</span>
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina Note that if the <span><strong class="command">named</strong></span> daemon is running as an
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina unprivileged user, it will not be able to bind to new restricted
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina ports if the server is reloaded.
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina<div class="titlepage"><div><div><h2 class="title" style="clear: both">
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina<a name="dynamic_update_security"></a>Dynamic Update Security</h2></div></div></div>
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina Access to the dynamic
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina update facility should be strictly limited. In earlier versions of
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina <span class="acronym">BIND</span> the only way to do this was
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina based on the IP
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina address of the host requesting the update, by listing an IP address
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina network prefix in the <span><strong class="command">allow-update</strong></span>
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina This method is insecure since the source address of the update UDP
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina is easily forged. Also note that if the IP addresses allowed by the
132e477d69e07e02fe6e4d668c0bb6226206474aPavel Březina <span><strong class="command">allow-update</strong></span> option include the
8fe171bf5a7a570591418e6548105f1d5a0097b3Pavel Březina address of a slave
8fe171bf5a7a570591418e6548105f1d5a0097b3Pavel Březina server which performs forwarding of dynamic updates, the master can
8fe171bf5a7a570591418e6548105f1d5a0097b3Pavel Březina trivially attacked by sending the update to the slave, which will
8fe171bf5a7a570591418e6548105f1d5a0097b3Pavel Březina forward it to the master with its own source IP address causing the
8fe171bf5a7a570591418e6548105f1d5a0097b3Pavel Březina master to approve it without question.
8fe171bf5a7a570591418e6548105f1d5a0097b3Pavel Březina For these reasons, we strongly recommend that updates be
8fe171bf5a7a570591418e6548105f1d5a0097b3Pavel Březina cryptographically authenticated by means of transaction signatures
8fe171bf5a7a570591418e6548105f1d5a0097b3Pavel Březina (TSIG). That is, the <span><strong class="command">allow-update</strong></span>
8214510f125879c3b1d247f2ce981ee20b5375d1Jakub Hrozek option should