Bv9ARM.ch07.html revision dcfda24abf565c442d058cbf81b2180d847a1b3e
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - Copyright (C) 2000-2003 Internet Software Consortium.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - Permission to use, copy, modify, and/or distribute this software for any
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - purpose with or without fee is hereby granted, provided that the above
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - copyright notice and this permission notice appear in all copies.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - PERFORMANCE OF THIS SOFTWARE.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<!-- $Id: Bv9ARM.ch07.html,v 1.239 2011/01/05 01:14:08 tbox Exp $ -->
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<title>Chapter�7.�BIND 9 Security Considerations</title>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="prev" href="Bv9ARM.ch06.html" title="Chapter�6.�BIND 9 Configuration Reference">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="next" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<table width="100%" summary="Navigation header">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<tr><th colspan="3" align="center">Chapter�7.�<acronym class="acronym">BIND</acronym> 9 Security Considerations</th></tr>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<a accesskey="p" href="Bv9ARM.ch06.html">Prev</a>�</td>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch08.html">Next</a>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<div class="titlepage"><div><div><h2 class="title">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<a name="Bv9ARM.ch07"></a>Chapter�7.�<acronym class="acronym">BIND</acronym> 9 Security Considerations</h2></div></div></div>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2602094"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2602312">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2602372">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<div class="titlepage"><div><div><h2 class="title" style="clear: both">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<a name="Access_Control_Lists"></a>Access Control Lists</h2></div></div></div>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Access Control Lists (ACLs) are address match lists that
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster you can set up and nickname for future use in <span><strong class="command">allow-notify</strong></span>,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <span><strong class="command">allow-query</strong></span>, <span><strong class="command">allow-query-on</strong></span>,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <span><strong class="command">allow-recursion</strong></span>, <span><strong class="command">allow-recursion-on</strong></span>,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <span><strong class="command">blackhole</strong></span>, <span><strong class="command">allow-transfer</strong></span>,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Using ACLs allows you to have finer control over who can access
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster your name server, without cluttering up your config files with huge
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster lists of IP addresses.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster It is a <span class="emphasis"><em>good idea</em></span> to use ACLs, and to
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster control access to your server. Limiting access to your server by
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster outside parties can help prevent spoofing and denial of service (DoS) attacks against
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster your server.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Here is an example of how to properly apply ACLs:
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster// Set up an ACL named "bogusnets" that will block
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster// RFC1918 space and some reserved space, which is
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster// commonly used in spoofing attacks.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosteracl bogusnets {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster// Set up an ACL called our-nets. Replace this with the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster// real IP numbers.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster allow-query { our-nets; };
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster allow-recursion { our-nets; };
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster blackhole { bogusnets; };
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster type master;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster allow-query { any; };
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster This allows recursive queries of the server from the outside
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster unless recursion has been previously disabled.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster For more information on how to use ACLs to protect your server,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster see the <span class="emphasis"><em>AUSCERT</em></span> advisory at:
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <a href="ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos" target="_top">ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos</a>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<div class="titlepage"><div><div><h2 class="title" style="clear: both">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<a name="id2602094"></a><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster On UNIX servers, it is possible to run <acronym class="acronym">BIND</acronym>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster in a <span class="emphasis"><em>chrooted</em></span> environment (using
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster the <span><strong class="command">chroot()</strong></span> function) by specifying
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster the "<code class="option">-t</code>" option for <span><strong class="command">named</strong></span>.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster This can help improve system security by placing
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <acronym class="acronym">BIND</acronym> in a "sandbox", which will limit
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster the damage done if a server is compromised.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Another useful feature in the UNIX version of <acronym class="acronym">BIND</acronym> is the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ability to run the daemon as an unprivileged user ( <code class="option">-u</code> <em class="replaceable"><code>user</code></em> ).
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster We suggest running as an unprivileged user when using the <span><strong class="command">chroot</strong></span> feature.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Here is an example command line to load <acronym class="acronym">BIND</acronym> in a <span><strong class="command">chroot</strong></span> sandbox,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <span><strong class="command">/var/named</strong></span>, and to run <span><strong class="command">named</strong></span> <span><strong class="command">setuid</strong></span> to
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <strong class="userinput"><code>/usr/local/sbin/named -u 202 -t /var/named</code></strong>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<div class="titlepage"><div><div><h3 class="title">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<a name="id2602312"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster In order for a <span><strong class="command">chroot</strong></span> environment
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster work properly in a particular directory
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (for example, <code class="filename">/var/named</code>),
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster you will need to set up an environment that includes everything
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <acronym class="acronym">BIND</acronym> needs to run.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster From <acronym class="acronym">BIND</acronym>'s point of view, <code class="filename">/var/named</code> is
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster the root of the filesystem. You will need to adjust the values of
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster options like
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster like <span><strong class="command">directory</strong></span> and <span><strong class="command">pid-file</strong></span> to account
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Unlike with earlier versions of BIND, you typically will
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <span class="emphasis"><em>not</em></span> need to compile <span><strong class="command">named</strong></span>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster statically nor install shared libraries under the new root.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster However, depending on your operating system, you may need
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster to set up things like
<a name="id2602372"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div>