Next
Previous
Contents
This is the Chroot-BIND8 HOWTO; see
Where? for the
master site, which contains the latest copy. It is assumed that you already
know how to configure and use BIND (the Berkeley Internet Name Domain). If
not, I would recommend that you read the DNS HOWTO first. It is also assumed
that you have a basic familiarity with compiling and installing software on
your UNIX-like system.
This document describes some extra security precautions that you can take when
you install BIND. It explains how to configure BIND so that it resides in a
``chroot jail'', meaning that it cannot see or access files outside its own
little directory tree. We shall also configure it to run as a non-root user.
The idea behind chroot is fairly simple. When you run BIND (or any other
process) in a chroot jail, the process is simply unable to see any part of the
filesystem outside the jail. For example, in this document, we'll set BIND up
to run chrooted to the directory /chroot/named. Well, to BIND, the
contents of this directory will appear to be /, the root directory.
Nothing outside this directory will be accessible to it. You've probably
encounted a chroot jail before, if you've ever ftped into a public system.
The idea behind running BIND in a chroot jail is to limit the amount of access
any malicious individual could gain by exploiting vulnerabilities in BIND. It
is for the same reason that we run BIND as a non-root user.
This should be considered as a supplement to the normal security precautions
(running the latest version, using access control, etc.), not a replacement for
them.
If you're interested in DNS security, you might also be interested in a few
other products. Building BIND with
StackGuard would
probably be a good idea for even more protection. Using it is easy; it's
just like using ordinary gcc. Also,
DNScache is a secure replacement
for BIND, written by Dan Bernstein. Dan is the author of qmail, and DNScache
appears to follow a similar philosophy.
The latest version of this document is always available from the web site of the
Linux/Open Source Users of Regina, Sask., at
http://www.losurs.org/docs/howto/Chroot-BIND8.html.
There is now a Japanese translation of this document, maintained by nakano
at apm.seikei.ac.jp. This is available at
http://www.linux.or.jp/JF/JFdocs/Chroot-BIND8-HOWTO.html.
BIND is available from
the Internet Software Consortium at
http://www.isc.org/bind.html. As of this
writing, the current version of BIND 8 is 8.2.4. BIND 9.x has now been
released, and has been around for a little while. You may consider upgrading
to it; the chroot process is certainly much simpler and cleaner. If you are
running BIND 9, then you want the Chroot-BIND HOWTO, which should be available
from the same location as this document.
Keep in mind that there are known security holes in all
versions of BIND 8 less than 8.2.3, so make very sure that you're
running the latest version!
I wrote this document based on my experiences in setting BIND up in a chroot
environment. In my case, I already had an existing BIND installation in the
form of a package that came with my Linux distribution. I'll assume that most
of you are probably in the same situation, and will simply be transferring over
and modifying the configuration files from your existing BIND installation, and
then removing the package before installing the new one. Don't remove the
package yet, though; we may want some files from it first.
If this is not the case for you, you should still be able to follow this
document. The only difference is that, where I refer to copying an existing
file, you first have to create it yourself. The DNS HOWTO may be helpful for
this.
These steps worked for me, on my system. Your mileage may vary. This is but
one way to approach this; there are other ways to set the same thing up
(although the general approach will be the same). It just happens that this
was the first way that I tried that worked, so I wrote it down.
My BIND experience to date has been installing on Linux servers. However, most
of the instructions in this document should be easily applicable to other
flavours of UNIX as well, and I shall try to point out differences of which I am
aware.
Next
Previous
Contents
|
