Bv9ARM.ch07.html revision fafd1d771905532e8dc3efa2ce90ce4c9e74af61
1N/A<HTML
1N/A><HEAD
1N/A><TITLE
1N/A>BIND 9 Security Considerations</TITLE
1N/A><META
1N/ANAME="GENERATOR"
1N/ACONTENT="Modular DocBook HTML Stylesheet Version 1.57"><LINK
1N/AREL="HOME"
1N/AHREF="Bv9ARM.html"><LINK
1N/AREL="PREVIOUS"
1N/ATITLE="BIND 9 Configuration Reference"
1N/AHREF="Bv9ARM.ch06.html"><LINK
1N/AREL="NEXT"
1N/ATITLE="Troubleshooting"
1N/AHREF="Bv9ARM.ch08.html"></HEAD
1N/A><BODY
1N/ACLASS="chapter"
1N/ABGCOLOR="#FFFFFF"
1N/ATEXT="#000000"
1N/ALINK="#0000FF"
1N/AVLINK="#840084"
1N/AALINK="#0000FF"
1N/A><DIV
1N/ACLASS="NAVHEADER"
1N/A><TABLE
1N/AWIDTH="100%"
1N/ABORDER="0"
1N/ACELLPADDING="0"
1N/ACELLSPACING="0"
1N/A><TR
1N/A><TH
1N/ACOLSPAN="3"
1N/AALIGN="center"
1N/A></TH
1N/A></TR
1N/A><TR
1N/A><TD
1N/AWIDTH="10%"
1N/AALIGN="left"
1N/AVALIGN="bottom"
1N/A><A
1N/AHREF="Bv9ARM.ch06.html"
1N/A>Prev</A
1N/A></TD
1N/A><TD
1N/AWIDTH="80%"
1N/AALIGN="center"
1N/AVALIGN="bottom"
1N/A></TD
1N/A><TD
1N/AWIDTH="10%"
1N/AALIGN="right"
1N/AVALIGN="bottom"
1N/A><A
1N/AHREF="Bv9ARM.ch08.html"
1N/A>Next</A
1N/A></TD
1N/A></TR
1N/A></TABLE
1N/A><HR
1N/AALIGN="LEFT"
1N/AWIDTH="100%"></DIV
1N/A><DIV
1N/ACLASS="chapter"
1N/A><H1
1N/A><A
1N/ANAME="ch07"
1N/A>Chapter 7. <SPAN
1N/ACLASS="acronym"
1N/A>BIND</SPAN
1N/A> 9 Security Considerations</A
1N/A></H1
1N/A><DIV
1N/ACLASS="TOC"
1N/A><DL
1N/A><DT
1N/A><B
1N/A>Table of Contents</B
1N/A></DT
1N/A><DT
1N/A>7.1. <A
1N/AHREF="Bv9ARM.ch07.html#Access_Control_Lists"
1N/A>Access Control Lists</A
1N/A></DT
1N/A><DT
1N/A>7.2. <A
1N/AHREF="Bv9ARM.ch07.html#AEN3805"
1N/A><B
1N/ACLASS="command"
1N/A>chroot</B
1N/A> and <B
1N/ACLASS="command"
1N/A>setuid</B
1N/A> (for
1N/AUNIX servers)</A
1N/A></DT
1N/A><DT
1N/A>7.3. <A
1N/AHREF="Bv9ARM.ch07.html#AEN3851"
1N/A>Dynamic Updates</A
1N/A></DT
1N/A></DL
1N/A></DIV
1N/A><DIV
1N/ACLASS="sect1"
1N/A><H1
1N/ACLASS="sect1"
1N/A><A
1N/ANAME="Access_Control_Lists"
1N/A>7.1. Access Control Lists</A
1N/A></H1
1N/A><P
1N/A>Access Control Lists (ACLs), are address match lists that
1N/Ayou can set up and nickname for future use in <B
1N/ACLASS="command"
1N/A>allow-query</B
1N/A>, <B
1N/ACLASS="command"
1N/A>allow-recursion</B
1N/A>, <B
1N/ACLASS="command"
1N/A>blackhole</B
1N/A>, <B
1N/ACLASS="command"
1N/A>allow-transfer</B
1N/A>,
1N/Aetc.</P
1N/A><P
1N/A>Using ACLs allows you to have finer control over who can access
1N/Ayour nameserver, without cluttering up your config files with huge
1N/Alists of IP addresses.</P
1N/A><P
1N/A>It is a <I
1N/ACLASS="emphasis"
1N/A>good idea</I
1N/A> to use ACLs, and to
1N/Acontrol access to your server. Limiting access to your server by
1N/Aoutside parties can help prevent spoofing and DoS attacks against
1N/Ayour server.</P
1N/A><P
1N/A>Here is an example of how to properly apply ACLs:</P
1N/A><PRE
1N/ACLASS="programlisting"
1N/A>&#13;// Set up an ACL named "bogusnets" that will block RFC1918 space,
1N/A// which is commonly used in spoofing attacks.
1N/Aacl bogusnets { 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3; 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; };
1N/A// Set up an ACL called our-nets. Replace this with the real IP numbers.
1N/Aacl our-nets { x.x.x.x/24; x.x.x.x/21; };
1N/Aoptions {
1N/A ...
1N/A ...
1N/A allow-query { our-nets; };
1N/A allow-recursion { our-nets; };
1N/A ...
1N/A blackhole { bogusnets; };
1N/A ...
1N/A};
1N/Azone "example.com" {
1N/A type master;
1N/A file "m/example.com";
1N/A allow-query { any; };
1N/A};
1N/A</PRE
1N/A><P
1N/A>This allows recursive queries of the server from the outside
1N/Aunless recursion has been previously disabled.</P
1N/A><P
1N/A>For more information on how to use ACLs to protect your server,
1N/Asee the <I
1N/ACLASS="emphasis"
1N/A>AUSCERT</I
1N/A> advisory at
1N/A<A
1N/AHREF="ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos"
1N/ATARGET="_top"
1N/A>ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos</A
1N/A></P
1N/A></DIV
1N/A><DIV
1N/ACLASS="sect1"
1N/A><H1
1N/ACLASS="sect1"
1N/A><A
1N/ANAME="AEN3805"
1N/A>7.2. <B
1N/ACLASS="command"
1N/A>chroot</B
1N/A> and <B
1N/ACLASS="command"
1N/A>setuid</B
1N/A> (for
1N/AUNIX servers)</A
1N/A></H1
1N/A><P
1N/A>On UNIX servers, it is possible to run <SPAN
1N/ACLASS="acronym"
1N/A>BIND</SPAN
1N/A> in a <I
1N/ACLASS="emphasis"
1N/A>chrooted</I
1N/A> environment
1N/A(<B
1N/ACLASS="command"
1N/A>chroot()</B
1N/A>) by specifying the "<TT
1N/ACLASS="option"
1N/A>-t</TT
1N/A>"
1N/Aoption. This can help improve system security by placing <SPAN
1N/ACLASS="acronym"
1N/A>BIND</SPAN
1N/A> in
1N/Aa "sandbox," which will limit the damage done if a server is compromised.</P
1N/A><P
1N/A>Another useful feature in the UNIX version of <SPAN
1N/ACLASS="acronym"
1N/A>BIND</SPAN
1N/A> is the
1N/Aability to run the daemon as a nonprivileged user ( <TT
1N/ACLASS="option"
1N/A>-u</TT
1N/A> <TT
1N/ACLASS="replaceable"
1N/A><I
1N/A>user</I
1N/A></TT
1N/A> ).
1N/AWe suggest running as a nonprivileged user when using the <B
1N/ACLASS="command"
1N/A>chroot</B
1N/A> feature.</P
1N/A><P
1N/A>Here is an example command line to load <SPAN
1N/ACLASS="acronym"
1N/A>BIND</SPAN
1N/A> in a <B
1N/ACLASS="command"
1N/A>chroot()</B
1N/A> sandbox,
1N/A<B
1N/ACLASS="command"
1N/A>/var/named</B
1N/A>, and to run <B
1N/ACLASS="command"
1N/A>named</B
1N/A> <B
1N/ACLASS="command"
1N/A>setuid</B
1N/A> to
1N/Auser 202:</P
1N/A><P
1N/A><TT
1N/ACLASS="userinput"
1N/A><B
1N/A>/usr/local/bin/named -u 202 -t /var/named</B
1N/A></TT
1N/A></P
1N/A><DIV
1N/ACLASS="sect2"
1N/A><H2
1N/ACLASS="sect2"
1N/A><A
1N/ANAME="AEN3828"
1N/A>7.2.1. The <B
1N/ACLASS="command"
1N/A>chroot</B
1N/A> Environment</A
1N/A></H2
1N/A><P
1N/A>In order for a <B
1N/ACLASS="command"
1N/A>chroot()</B
1N/A> environment to
1N/Awork properly in a particular directory (for example, <TT
1N/ACLASS="filename"
1N/A>/var/named</TT
1N/A>),
1N/Ayou will need to set up an environment that includes everything
1N/A<SPAN
1N/ACLASS="acronym"
1N/A>BIND</SPAN
1N/A> needs to run. From <SPAN
1N/ACLASS="acronym"
1N/A>BIND</SPAN
1N/A>'s point of view, <TT
1N/ACLASS="filename"
1N/A>/var/named</TT
1N/A> is
1N/Athe root of the filesystem. You will need <TT
1N/ACLASS="filename"
1N/A>/dev/null</TT
1N/A>,
1N/Aand any library directories and files that <SPAN
1N/ACLASS="acronym"
1N/A>BIND</SPAN
1N/A> needs to run on
1N/Ayour system. Please consult your operating system's instructions
1N/Aif you need help figuring out which library files you need to copy
1N/Aover to the <B
1N/ACLASS="command"
1N/A>chroot()</B
1N/A> sandbox.</P
1N/A><P
1N/A>If you are running an operating system that supports static
1N/Abinaries, you can also compile <SPAN
1N/ACLASS="acronym"
1N/A>BIND</SPAN
1N/A> statically and avoid the need
1N/Ato copy system libraries over to your <B
1N/ACLASS="command"
1N/A>chroot()</B
1N/A> sandbox.</P
1N/A></DIV
1N/A><DIV
1N/ACLASS="sect2"
1N/A><H2
1N/ACLASS="sect2"
1N/A><A
1N/ANAME="AEN3843"
1N/A>7.2.2. Using the <B
1N/ACLASS="command"
1N/A>setuid</B
1N/A> Function</A
1N/A></H2
1N/A><P
1N/A>Prior to running the <B
1N/ACLASS="command"
1N/A>named</B
1N/A> daemon, use
1N/Athe <B
1N/ACLASS="command"
1N/A>touch</B
1N/A> utility (to change file access and
1N/Amodification times) or the <B
1N/ACLASS="command"
1N/A>chown</B
1N/A> utility (to
1N/Aset the user id and/or group id) on files to which you want <SPAN
1N/ACLASS="acronym"
1N/A>BIND</SPAN
1N/A>
1N/Ato write.</P
1N/A></DIV
1N/A></DIV
1N/A><DIV
1N/ACLASS="sect1"
1N/A><H1
1N/ACLASS="sect1"
1N/A><A
1N/ANAME="AEN3851"
1N/A>7.3. Dynamic Updates</A
1N/A></H1
1N/A><P
1N/A>Access to the dynamic update facility should be strictly limited.
1N/AIn earlier versions of <SPAN
1N/ACLASS="acronym"
1N/A>BIND</SPAN
1N/A> the only way to do this was based on
1N/Athe IP address of the host requesting the update. <SPAN
1N/ACLASS="acronym"
1N/A>BIND9</SPAN
1N/A> also
1N/Asupports authenticating updates cryptographically by means of transaction
1N/Asignatures (TSIG). The use of TSIG is strongly recommended.</P
1N/A><P
1N/A>Some sites choose to keep all dynamically updated DNS data
1N/Ain a subdomain and delegate that subdomain to a separate zone. This
1N/Away, the top-level zone containing critical data such as the IP addresses
1N/Aof public web and mail servers need not allow dynamic update at
1N/Aall.</P
1N/A></DIV
1N/A></DIV
1N/A><DIV
1N/ACLASS="NAVFOOTER"
1N/A><HR
1N/AALIGN="LEFT"
1N/AWIDTH="100%"><TABLE
1N/AWIDTH="100%"
1N/ABORDER="0"
1N/ACELLPADDING="0"
1N/ACELLSPACING="0"
1N/A><TR
1N/A><TD
1N/AWIDTH="33%"
1N/AALIGN="left"
1N/AVALIGN="top"
1N/A><A
1N/AHREF="Bv9ARM.ch06.html"
1N/A>Prev</A
1N/A></TD
1N/A><TD
1N/AWIDTH="34%"
1N/AALIGN="center"
1N/AVALIGN="top"
1N/A><A
1N/AHREF="Bv9ARM.html"
1N/A>Home</A
1N/A></TD
1N/A><TD
1N/AWIDTH="33%"
1N/AALIGN="right"
1N/AVALIGN="top"
1N/A><A
1N/AHREF="Bv9ARM.ch08.html"
1N/A>Next</A
1N/A></TD
1N/A></TR
1N/A><TR
1N/A><TD
1N/AWIDTH="33%"
1N/AALIGN="left"
1N/AVALIGN="top"
1N/A><SPAN
1N/ACLASS="acronym"
1N/A>BIND</SPAN
1N/A> 9 Configuration Reference</TD
1N/A><TD
1N/AWIDTH="34%"
1N/AALIGN="center"
1N/AVALIGN="top"
1N/A>&nbsp;</TD
1N/A><TD
1N/AWIDTH="33%"
1N/AALIGN="right"
1N/AVALIGN="top"
1N/A>Troubleshooting</TD
1N/A></TR
1N/A></TABLE
1N/A></DIV
1N/A></BODY
1N/A></HTML
1N/A>