Bv9ARM.ch07.html revision ea91cb523112b44b4d2799ac7eb5e878721f2a59
2080N/A<HTML
3909N/A><HEAD
2080N/A><TITLE
2080N/A>BIND 9 Security Considerations</TITLE
2080N/A><META
2080N/ANAME="GENERATOR"
2362N/ACONTENT="Modular DocBook HTML Stylesheet Version 1.54"><LINK
2080N/AREL="HOME"
2362N/AHREF="Bv9ARM.html"><LINK
2080N/AREL="PREVIOUS"
2080N/ATITLE="BIND 9 Configuration Reference"
2080N/AHREF="Bv9ARM.ch06.html"><LINK
2080N/AREL="NEXT"
2080N/ATITLE="Troubleshooting"
2080N/AHREF="Bv9ARM.ch08.html"></HEAD
2080N/A><BODY
2080N/ACLASS="chapter"
2080N/ABGCOLOR="#FFFFFF"
2080N/ATEXT="#000000"
2080N/ALINK="#0000FF"
2362N/AVLINK="#840084"
2362N/AALINK="#0000FF"
2362N/A><DIV
2080N/ACLASS="NAVHEADER"
2080N/A><TABLE
2080N/AWIDTH="100%"
2080N/ABORDER="0"
2080N/ACELLPADDING="0"
2080N/ACELLSPACING="0"
2080N/A><TR
2080N/A><TH
2080N/ACOLSPAN="3"
2080N/AALIGN="center"
2080N/A></TH
2080N/A></TR
2080N/A><TR
2080N/A><TD
2080N/AWIDTH="10%"
2472N/AALIGN="left"
2080N/AVALIGN="bottom"
2080N/A><A
2080N/AHREF="Bv9ARM.ch06.html"
2080N/A>Prev</A
2080N/A></TD
2080N/A><TD
2080N/AWIDTH="80%"
2080N/AALIGN="center"
2080N/AVALIGN="bottom"
2080N/A></TD
2080N/A><TD
2080N/AWIDTH="10%"
2080N/AALIGN="right"
2080N/AVALIGN="bottom"
2080N/A><A
2080N/AHREF="Bv9ARM.ch08.html"
2080N/A>Next</A
2080N/A></TD
2080N/A></TR
2080N/A></TABLE
2608N/A><HR
2608N/AALIGN="LEFT"
2608N/AWIDTH="100%"></DIV
2608N/A><DIV
2608N/ACLASS="chapter"
2608N/A><H1
2608N/A><A
2608N/ANAME="ch07"
2608N/A>Chapter 7. <SPAN
2608N/ACLASS="acronym"
2608N/A>BIND</SPAN
2608N/A> 9 Security Considerations</A
2608N/A></H1
2608N/A><DIV
2608N/ACLASS="TOC"
2608N/A><DL
2608N/A><DT
2608N/A><B
2608N/A>Table of Contents</B
2080N/A></DT
2080N/A><DT
2080N/A>7.1. <A
2080N/AHREF="Bv9ARM.ch07.html#Access_Control_Lists"
2080N/A>Access Control Lists</A
2080N/A></DT
2080N/A><DT
2080N/A>7.2. <A
2080N/AHREF="Bv9ARM.ch07.html#AEN3806"
2080N/A><B
2080N/ACLASS="command"
2080N/A>chroot</B
2080N/A> and <B
2080N/ACLASS="command"
2080N/A>setuid</B
2080N/A> (for
2080N/AUNIX servers)</A
2080N/A></DT
2080N/A><DT
2080N/A>7.3. <A
2080N/AHREF="Bv9ARM.ch07.html#AEN3852"
2080N/A>Dynamic Updates</A
2080N/A></DT
2080N/A></DL
2080N/A></DIV
2080N/A><DIV
2080N/ACLASS="sect1"
2080N/A><H1
2080N/ACLASS="sect1"
2080N/A><A
2080N/ANAME="Access_Control_Lists"
2080N/A>7.1. Access Control Lists</A
2080N/A></H1
2080N/A><P
2080N/A>Access Control Lists (ACLs), are address match lists that
2246N/Ayou can set up and nickname for future use in <B
2246N/ACLASS="command"
2246N/A>allow-query</B
2080N/A>, <B
2080N/ACLASS="command"
2080N/A>allow-recursion</B
2080N/A>, <B
2080N/ACLASS="command"
2080N/A>blackhole</B
2080N/A>, <B
2080N/ACLASS="command"
2080N/A>allow-transfer</B
2080N/A>,
2080N/Aetc.</P
2080N/A><P
2080N/A>Using ACLs allows you to have finer control over who can access
2080N/Ayour nameserver, without cluttering up your config files with huge
2080N/Alists of IP addresses.</P
2080N/A><P
>It is a <I
CLASS="emphasis"
>good idea</I
> to use ACLs, and to
control access to your server. Limiting access to your server by
outside parties can help prevent spoofing and DoS attacks against
your server.</P
><P
>Here is an example of how to properly apply ACLs:</P
><PRE
CLASS="programlisting"
>&#13;// Set up an ACL named "bogusnets" that will block RFC1918 space,
// which is commonly used in spoofing attacks.
acl bogusnets { 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3; 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; };
// Set up an ACL called our-nets. Replace this with the real IP numbers.
acl our-nets { x.x.x.x/24; x.x.x.x/21; };
options {
...
...
allow-query { our-nets; };
allow-recursion { our-nets; };
...
blackhole { bogusnets; };
...
};
zone "example.com" {
type master;
file "m/example.com";
allow-query { any; };
};
</PRE
><P
>This allows recursive queries of the server from the outside
unless recursion has been previously disabled.</P
><P
>For more information on how to use ACLs to protect your server,
see the <I
CLASS="emphasis"
>AUSCERT</I
> advisory at
<A
HREF="ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos"
TARGET="_top"
>ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos</A
></P
></DIV
><DIV
CLASS="sect1"
><H1
CLASS="sect1"
><A
NAME="AEN3806"
>7.2. <B
CLASS="command"
>chroot</B
> and <B
CLASS="command"
>setuid</B
> (for
UNIX servers)</A
></H1
><P
>On UNIX servers, it is possible to run <SPAN
CLASS="acronym"
>BIND</SPAN
> in a <I
CLASS="emphasis"
>chrooted</I
> environment
(<B
CLASS="command"
>chroot()</B
>) by specifying the "<TT
CLASS="option"
>-t</TT
>"
option. This can help improve system security by placing <SPAN
CLASS="acronym"
>BIND</SPAN
> in
a "sandbox," which will limit the damage done if a server is compromised.</P
><P
>Another useful feature in the UNIX version of <SPAN
CLASS="acronym"
>BIND</SPAN
> is the
ability to run the daemon as a nonprivileged user ( <TT
CLASS="option"
>-u</TT
> <TT
CLASS="replaceable"
><I
>user</I
></TT
> ).
We suggest running as a nonprivileged user when using the <B
CLASS="command"
>chroot</B
> feature.</P
><P
>Here is an example command line to load <SPAN
CLASS="acronym"
>BIND</SPAN
> in a <B
CLASS="command"
>chroot()</B
> sandbox,
<B
CLASS="command"
>/var/named</B
>, and to run <B
CLASS="command"
>named</B
> <B
CLASS="command"
>setuid</B
> to
user 202:</P
><P
><TT
CLASS="userinput"
><B
>/usr/local/bin/named -u 202 -t /var/named</B
></TT
></P
><DIV
CLASS="sect2"
><H2
CLASS="sect2"
><A
NAME="AEN3829"
>7.2.1. The <B
CLASS="command"
>chroot</B
> Environment</A
></H2
><P
>In order for a <B
CLASS="command"
>chroot()</B
> environment to
work properly in a particular directory (for example, <TT
CLASS="filename"
>/var/named</TT
>),
you will need to set up an environment that includes everything
<SPAN
CLASS="acronym"
>BIND</SPAN
> needs to run. From <SPAN
CLASS="acronym"
>BIND</SPAN
>'s point of view, <TT
CLASS="filename"
>/var/named</TT
> is
the root of the filesystem. You will need <TT
CLASS="filename"
>/dev/null</TT
>,
and any library directories and files that <SPAN
CLASS="acronym"
>BIND</SPAN
> needs to run on
your system. Please consult your operating system's instructions
if you need help figuring out which library files you need to copy
over to the <B
CLASS="command"
>chroot()</B
> sandbox.</P
><P
>If you are running an operating system that supports static
binaries, you can also compile <SPAN
CLASS="acronym"
>BIND</SPAN
> statically and avoid the need
to copy system libraries over to your <B
CLASS="command"
>chroot()</B
> sandbox.</P
></DIV
><DIV
CLASS="sect2"
><H2
CLASS="sect2"
><A
NAME="AEN3844"
>7.2.2. Using the <B
CLASS="command"
>setuid</B
> Function</A
></H2
><P
>Prior to running the <B
CLASS="command"
>named</B
> daemon, use
the <B
CLASS="command"
>touch</B
> utility (to change file access and
modification times) or the <B
CLASS="command"
>chown</B
> utility (to
set the user id and/or group id) on files to which you want <SPAN
CLASS="acronym"
>BIND</SPAN
>
to write.</P
></DIV
></DIV
><DIV
CLASS="sect1"
><H1
CLASS="sect1"
><A
NAME="AEN3852"
>7.3. Dynamic Updates</A
></H1
><P
>Access to the dynamic update facility should be strictly limited.
In earlier versions of <SPAN
CLASS="acronym"
>BIND</SPAN
> the only way to do this was based on
the IP address of the host requesting the update. <SPAN
CLASS="acronym"
>BIND9</SPAN
> also
supports authenticating updates cryptographically by means of transaction
signatures (TSIG). The use of TSIG is strongly recommended.</P
><P
>Some sites choose to keep all dynamically updated DNS data
in a subdomain and delegate that subdomain to a separate zone. This
way, the top-level zone containing critical data such as the IP addresses
of public web and mail servers need not allow dynamic update at
all.</P
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="Bv9ARM.ch06.html"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="Bv9ARM.html"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="Bv9ARM.ch08.html"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><SPAN
CLASS="acronym"
>BIND</SPAN
> 9 Configuration Reference</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Troubleshooting</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>