Chroot-BIND8-HOWTO(1).pdf

Chroot−BIND8 HOWTO

Table of Contents

Chroot−BIND8 HOWTO. ..................................................................................................................................1

Scott Wunsch, scott at wunsch.org. .........................................................................................................1

1. Introduction. .........................................................................................................................................1

2. Preparing the Jai.. ................................................................................................................................1

3. Compiling BIND.. ................................................................................................................................1

4. Installing Your Shiny New BIND.. ......................................................................................................1

5. The End. ...............................................................................................................................................1

6. Appendix − Upgrading BIND Later. ...................................................................................................2

7. Appendix − Thanks. .............................................................................................................................2

8. Appendix − Document Distribution Policy. ........................................................................................2

1. Introduction. .........................................................................................................................................2

1.1 What?. ................................................................................................................................................2

1.2 Why?. .................................................................................................................................................2

1.3 Where?. .............................................................................................................................................2

1.4 How?. .................................................................................................................................................3

1.5 Disclaimer. .........................................................................................................................................3

2. Preparing the Jai.. ................................................................................................................................3

2.1 Creating a User. .................................................................................................................................3

2.2 Directory Structure.. ...........................................................................................................................4

2.3 Placing the BIND Data. .....................................................................................................................4

2.4 System Support Files. ........................................................................................................................4

2.5 Logging. ............................................................................................................................................5

The Ideal Solution. ......................................................................................................................5

The Other Solutions. ...................................................................................................................6

3. Compiling BIND.. ...............................................................................................................................6

3.1 Modifying Paths. ................................................................................................................................6

3.2 Doing the Build. .................................................................................................................................7

4. Installing Your Shiny New BIND. ......................................................................................................7

4.1 Installing the Tools Outside the Jail ..................................................................................................7

4.2 Installing the Binaries in the Jai. .......................................................................................................8

4.3 Setting up the Init Script. ...................................................................................................................8

4.4 Configuration Changes. .....................................................................................................................9

5. The End. .............................................................................................................................................10

5.1 Launching BIND. .............................................................................................................................10

5.2 That's It!. ..........................................................................................................................................10

6. Appendix − Upgrading BIND Later. ................................................................................................10

7. Appendix − Thanks. ..........................................................................................................................10

8. Appendix − Document Distribution Policy. .....................................................................................11

Chroot−BIND8 HOWTO

Scott Wunsch, scott at wunsch.org

v1.4, 1 July 2001

This document describes installing the BIND 8 nameserver to run in a chroot jail and as a non−root user, to

provide added security and minimise the potential effects of a security compromise. This version of the

document covers the old but still popular BIND 8; there is another document which provides similar

information for BIND 9.

1. Introduction

· 1.2 Why?

1.1 What?

· 1.3 Where?

· 1.4 How?

· 1.5 Disclaimer

2. Preparing the Jail

· 2.2 Directory Structure

2.1 Creating a User

· 2.3 Placing the BIND Data

· 2.4 System Support Files

· 2.5 Logging

3. Compiling BIND

· 3.2 Doing the Build

3.1 Modifying Paths

4. Installing Your Shiny New BIND

· 4.2 Installing the Binaries in the Jail

4.1 Installing the Tools Outside the Jail

· 4.3 Setting up the Init Script

· 4.4 Configuration Changes

5. The End

· 5.2 That's It!

5.1 Launching BIND

Chroot−BIND8 HOWTO

Chroot−BIND8 HOWTO

6. Appendix − Upgrading BIND Later

7. Appendix − Thanks

8. Appendix − Document Distribution Policy

1. Introduction

This is the Chroot−BIND8 HOWTO; see Where? for the master site, which contains the latest copy. It is

assumed that you already know how to configure and use BIND (the Berkeley Internet Name Domain). If

not, I would recommend that you read the DNS HOWTO first. It is also assumed that you have a basic

familiarity with compiling and installing software on your UNIX−like system.

1.1 What?

This document describes some extra security precautions that you can take when you install BIND. It

explains how to configure BIND so that it resides in a ``chroot jail'', meaning that it cannot see or access files

outside its own little directory tree. We shall also configure it to run as a non−root user.

The idea behind chroot is fairly simple. When you run BIND (or any other process) in a chroot jail, the

process is simply unable to see any part of the filesystem outside the jail. For example, in this document, we'll

set BIND up to run chrooted to the directory /chroot/named . Well, to BIND, the contents of this

directory will appear to be / , the root directory. Nothing outside this directory will be accessible to it. You've

probably encounted a chroot jail before, if you've ever ftped into a public system.

1.2 Why?

The idea behind running BIND in a chroot jail is to limit the amount of access any malicious individual could

gain by exploiting vulnerabilities in BIND. It is for the same reason that we run BIND as a non−root user.

This should be considered as a supplement to the normal security precautions (running the latest version,

using access control, etc.), not a replacement for them.

If you're interested in DNS security, you might also be interested in a few other products. Building BIND

with StackGuard would probably be a good idea for even more protection. Using it is easy; it's just like using

ordinary gcc. Also, DNScache is a secure replacement for BIND, written by Dan Bernstein. Dan is the author

of qmail, and DNScache appears to follow a similar philosophy.

1.3 Where?

The latest version of this document is always available from the web site of the Linux/Open Source Users of

Regina, Sask., at http://www.losurs.org/docs/howto/Chroot−BIND8.html .

There is now a Japanese translation of this document, maintained by nakano at apm.seikei.ac.jp .

This is available at http://www.linux.or.jp/JF/JFdocs/Chroot−BIND8−HOWTO.html .

6. Appendix − Upgrading BIND Later

Chroot−BIND8 HOWTO

BIND is available from the Internet Software Consortium at http://www.isc.org/bind.html . As of this writing,

the current version of BIND 8 is 8.2.4. BIND 9.x has now been released, and has been around for a little

while. You may consider upgrading to it; the chroot process is certainly much simpler and cleaner. If you are

running BIND 9, then you want the Chroot−BIND HOWTO, which should be available from the same

location as this document.

Keep in mind that there are known security holes in all versions of BIND 8 less than 8.2.3 , so make very sure

that you're running the latest version!

1.4 How?

I wrote this document based on my experiences in setting BIND up in a chroot environment. In my case, I

already had an existing BIND installation in the form of a package that came with my Linux distribution. I'll

assume that most of you are probably in the same situation, and will simply be transferring over and

modifying the configuration files from your existing BIND installation, and then removing the package

before installing the new one. Don't remove the package yet, though; we may want some files from it first.

If this is not the case for you, you should still be able to follow this document. The only difference is that,

where I refer to copying an existing file, you first have to create it yourself. The DNS HOWTO may be

helpful for this.

1.5 Disclaimer

These steps worked for me, on my system. Your mileage may vary. This is but one way to approach this;

there are other ways to set the same thing up (although the general approach will be the same). It just happens

that this was the first way that I tried that worked, so I wrote it down.

My BIND experience to date has been installing on Linux servers. However, most of the instructions in this

document should be easily applicable to other flavours of UNIX as well, and I shall try to point out

differences of which I am aware.

2. Preparing the Jail

2.1 Creating a User

As mentioned in the introduction, it's not a good idea to run BIND as root. So, before we begin, let's create a

separate user for BIND. Note that you should never use an existing generic user like nobody for this

purpose. However, some distributions, such as SuSE and Linux Mandrake have started providing a specific

user (generally called named ); you can simply adapt this user for our purposes, if you like.

This requires adding a line something like the following to /etc/passwd :

named:x:200:200:Nameserver:/chroot/named:/bin/false

And one like this to /etc/group :

named:x:200:

1.4 How?

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: