Bv9ARM.ch07.html revision da335de4b5774d486cc975e1798ec6ca1f9eaaed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<HTML
990d0e893f5b70e735cdf990af66e9ec6e91fa78Tinderbox User><HEAD
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews><TITLE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND 9 Security Considerations</TITLE
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater><META
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinNAME="GENERATOR"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCONTENT="Modular DocBook HTML Stylesheet Version 1.73
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein"><LINK
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinREL="HOME"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinTITLE="BIND 9 Administrator Reference Manual"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinHREF="Bv9ARM.html"><LINK
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinREL="PREVIOUS"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinTITLE="BIND 9 Configuration Reference"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinHREF="Bv9ARM.ch06.html"><LINK
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinREL="NEXT"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinTITLE="Troubleshooting"
ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox UserHREF="Bv9ARM.ch08.html"></HEAD
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><BODY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="chapter"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinBGCOLOR="#FFFFFF"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinTEXT="#000000"
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark AndrewsLINK="#0000FF"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinVLINK="#840084"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinALINK="#0000FF"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><DIV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="NAVHEADER"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><TABLE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinSUMMARY="Header navigation table"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinWIDTH="100%"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinBORDER="0"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCELLPADDING="0"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCELLSPACING="0"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><TR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><TH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCOLSPAN="3"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinALIGN="center"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND 9 Administrator Reference Manual</TH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></TR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><TR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><TD
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinWIDTH="10%"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinALIGN="left"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinVALIGN="bottom"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinHREF="Bv9ARM.ch06.html"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinACCESSKEY="P"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>Prev</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></TD
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><TD
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinWIDTH="80%"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinALIGN="center"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserVALIGN="bottom"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User></TD
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><TD
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinWIDTH="10%"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserALIGN="right"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserVALIGN="bottom"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User><A
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserHREF="Bv9ARM.ch08.html"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserACCESSKEY="N"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User>Next</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></TD
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User></TR
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User></TABLE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><HR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinALIGN="LEFT"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserWIDTH="100%"></DIV
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User><DIV
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserCLASS="chapter"
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater><H1
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater><A
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic UpdaterNAME="ch07"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User>Chapter 7. <SPAN
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserCLASS="acronym"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User>BIND</SPAN
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User> 9 Security Considerations</A
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User></H1
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User><DIV
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserCLASS="TOC"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User><DL
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User><DT
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User><B
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User>Table of Contents</B
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User></DT
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User><DT
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater>7.1. <A
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic UpdaterHREF="Bv9ARM.ch07.html#Access_Control_Lists"
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater>Access Control Lists</A
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User></DT
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User><DT
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User>7.2. <A
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox UserHREF="Bv9ARM.ch07.html#AEN4671"
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User><B
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserCLASS="command"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User>chroot</B
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User> and <B
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserCLASS="command"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User>setuid</B
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User> (for
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserUNIX servers)</A
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater></DT
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User><DT
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater>7.3. <A
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserHREF="Bv9ARM.ch07.html#dynamic_update_security"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User>Dynamic Update Security</A
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User></DT
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User></DL
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User></DIV
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User><DIV
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserCLASS="sect1"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><H1
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect1"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinNAME="Access_Control_Lists"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>7.1. Access Control Lists</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></H1
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews>Access Control Lists (ACLs), are address match lists that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinyou can set up and nickname for future use in <B
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark AndrewsCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>allow-notify</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews>allow-query</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>, <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>allow-recursion</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews>blackhole</B
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews>, <B
58d9e9169e7ab4355a0b0bfc13bc616bc5247dfeAutomatic UpdaterCLASS="command"
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews>allow-transfer</B
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews>,
58d9e9169e7ab4355a0b0bfc13bc616bc5247dfeAutomatic Updateretc.</P
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews><P
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews>Using ACLs allows you to have finer control over who can access
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinyour name server, without cluttering up your config files with huge
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinlists of IP addresses.</P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>It is a <SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>good idea</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> to use ACLs, and to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeincontrol access to your server. Limiting access to your server by
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrewsoutside parties can help prevent spoofing and DoS attacks against
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updateryour server.</P
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater><P
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater>Here is an example of how to properly apply ACLs:</P
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater><PRE
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic UpdaterCLASS="programlisting"
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater>&#13;// Set up an ACL named "bogusnets" that will block RFC1918 space,
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater// which is commonly used in spoofing attacks.
ca67ebfe9eef0b8f04179f7e511a19e0337a5422Automatic Updateracl bogusnets { 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3; 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; };
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater// Set up an ACL called our-nets. Replace this with the real IP numbers.
852ccdd42a71550c974111b49415204ffeca6573Automatic Updateracl our-nets { x.x.x.x/24; x.x.x.x/21; };
852ccdd42a71550c974111b49415204ffeca6573Automatic Updateroptions {
66f25f2ceeb589e67efe7af2413baaa3426b0042Automatic Updater ...
66f25f2ceeb589e67efe7af2413baaa3426b0042Automatic Updater ...
66f25f2ceeb589e67efe7af2413baaa3426b0042Automatic Updater allow-query { our-nets; };
66f25f2ceeb589e67efe7af2413baaa3426b0042Automatic Updater allow-recursion { our-nets; };
66f25f2ceeb589e67efe7af2413baaa3426b0042Automatic Updater ...
66f25f2ceeb589e67efe7af2413baaa3426b0042Automatic Updater blackhole { bogusnets; };
66f25f2ceeb589e67efe7af2413baaa3426b0042Automatic Updater ...
66f25f2ceeb589e67efe7af2413baaa3426b0042Automatic Updater};
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinzone "example.com" {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein type master;
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater file "m/example.com";
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater allow-query { any; };
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater};
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater</PRE
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>This allows recursive queries of the server from the outside
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinunless recursion has been previously disabled.</P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>For more information on how to use ACLs to protect your server,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinsee the <SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>AUSCERT</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> advisory at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinHREF="ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinTARGET="_top"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></DIV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><DIV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect1"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><H1
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect1"
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater><A
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic UpdaterNAME="AEN4671"
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater>7.2. <B
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic UpdaterCLASS="command"
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater>chroot</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> and <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>setuid</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> (for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinUNIX servers)</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></H1
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>On UNIX servers, it is possible to run <SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="acronym"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND</SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> in a <SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>chrooted</I
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews></SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> environment
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein(<B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>chroot()</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>) by specifying the "<TT
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserCLASS="option"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User>-t</TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox Useroption. This can help improve system security by placing <SPAN
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserCLASS="acronym"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User>BIND</SPAN
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews> in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeina "sandbox", which will limit the damage done if a server is compromised.</P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User>Another useful feature in the UNIX version of <SPAN
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserCLASS="acronym"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User>BIND</SPAN
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User> is the
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox Userability to run the daemon as an unprivileged user ( <TT
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserCLASS="option"
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User>-u</TT
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User> <TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="replaceable"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>user</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> ).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinWe suggest running as an unprivileged user when using the <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>chroot</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> feature.</P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>Here is an example command line to load <SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="acronym"
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews>BIND</SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> in a <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>chroot()</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> sandbox,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>/var/named</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>, and to run <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>named</B
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews> <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>setuid</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinuser 202:</P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="userinput"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><B
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox User>/usr/local/bin/named -u 202 -t /var/named</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></P
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews><DIV
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark AndrewsCLASS="sect2"
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews><H2
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect2"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinNAME="AEN4694"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>7.2.1. The <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>chroot</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Environment</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></H2
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews>In order for a <B
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark AndrewsCLASS="command"
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews>chroot()</B
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews> environment to
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrewswork properly in a particular directory
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein(for example, <TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="filename"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>/var/named</TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>),
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinyou will need to set up an environment that includes everything
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="acronym"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND</SPAN
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews> needs to run.
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark AndrewsFrom <SPAN
794b79e6bbc3f5db1ea6ae154d739b9f1ef1a375Tinderbox UserCLASS="acronym"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND</SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>'s point of view, <TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="filename"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>/var/named</TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinthe root of the filesystem. You will need to adjust the values of options like
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinlike <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>directory</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> and <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>pid-file</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> to account
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinfor this.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein</P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>&#13;Unlike with earlier versions of BIND, you will typically
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="emphasis"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>not</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> need to compile <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>named</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinstatically nor install shared libraries under the new root.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinHowever, depending on your operating system, you may need
2cc6eb92f9443695bc32fa6eed372d983d261a35Automatic Updaterto set up things like
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="filename"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>/dev/zero</TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="filename"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>/dev/random</TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="filename"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>/dev/log</TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>, and/or
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="filename"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>/etc/localtime</TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein</P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></DIV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><DIV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect2"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><H2
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect2"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinNAME="AEN4712"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>7.2.2. Using the <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>setuid</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Function</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></H2
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>Prior to running the <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>named</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> daemon, use
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinthe <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>touch</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> utility (to change file access and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinmodification times) or the <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>chown</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> utility (to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinset the user id and/or group id) on files
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinto which you want <SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="acronym"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND</SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinto write. Note that if the <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>named</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> daemon is running as an
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinunprivileged user, it will not be able to bind to new restricted ports if the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinserver is reloaded.</P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></DIV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></DIV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><DIV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect1"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><H1
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="sect1"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinNAME="dynamic_update_security"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>7.3. Dynamic Update Security</A
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein></H1
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>Access to the dynamic
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinupdate facility should be strictly limited. In earlier versions of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="acronym"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND</SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> the only way to do this was based on the IP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinaddress of the host requesting the update, by listing an IP address or
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinnetwork prefix in the <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>allow-update</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> zone option.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinThis method is insecure since the source address of the update UDP packet
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinis easily forged. Also note that if the IP addresses allowed by the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="command"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>allow-update</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> option include the address of a slave
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinserver which performs forwarding of dynamic updates, the master can be
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrewstrivially attacked by sending the update to the slave, which will
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinforward it to the master with its own source IP address causing the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinmaster to approve it without question.</P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>For these reasons, we strongly recommend that updates be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeincryptographically authenticated by means of transaction signatures
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein(TSIG). That is, the <B
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric LuceCLASS="command"
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce>allow-update</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> option should
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Lucelist only TSIG key names, not IP addresses or network
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luceprefixes. Alternatively, the new <B
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceCLASS="command"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce>update-policy</B
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updateroption can be used.</P
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater><P
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews>Some sites choose to keep all dynamically updated DNS data
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Lucein a subdomain and delegate that subdomain to a separate zone. This
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updaterway, the top-level zone containing critical data such as the IP addresses
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updaterof public web and mail servers need not allow dynamic update at
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updaterall.</P
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater></DIV
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater></DIV
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater><DIV
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceCLASS="NAVFOOTER"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce><HR
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceALIGN="LEFT"
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric LuceWIDTH="100%"><TABLE
ac93437301f55ed69bf85883a497a75598c628f9Automatic UpdaterSUMMARY="Footer navigation table"
ac93437301f55ed69bf85883a497a75598c628f9Automatic UpdaterWIDTH="100%"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceBORDER="0"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceCELLPADDING="0"
ac93437301f55ed69bf85883a497a75598c628f9Automatic UpdaterCELLSPACING="0"
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater><TR
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce><TD
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceWIDTH="33%"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceALIGN="left"
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric LuceVALIGN="top"
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater><A
ac93437301f55ed69bf85883a497a75598c628f9Automatic UpdaterHREF="Bv9ARM.ch06.html"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceACCESSKEY="P"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce>Prev</A
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce></TD
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce><TD
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceWIDTH="34%"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceALIGN="center"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceVALIGN="top"
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce><A
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceHREF="Bv9ARM.html"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceACCESSKEY="H"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce>Home</A
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce></TD
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce><TD
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceWIDTH="33%"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceALIGN="right"
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric LuceVALIGN="top"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce><A
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceHREF="Bv9ARM.ch08.html"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceACCESSKEY="N"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce>Next</A
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce></TD
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce></TR
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce><TR
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce><TD
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinWIDTH="33%"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinALIGN="left"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinVALIGN="top"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein><SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="acronym"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND</SPAN
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce> 9 Configuration Reference</TD
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce><TD
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric LuceWIDTH="34%"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceALIGN="center"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric LuceVALIGN="top"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce>&nbsp;</TD
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater><TD
ac93437301f55ed69bf85883a497a75598c628f9Automatic UpdaterWIDTH="33%"
ac93437301f55ed69bf85883a497a75598c628f9Automatic UpdaterALIGN="right"
ac93437301f55ed69bf85883a497a75598c628f9Automatic UpdaterVALIGN="top"
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater>Troubleshooting</TD
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater></TR
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater></TABLE
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater></DIV
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce></BODY
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce></HTML
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce>