Chroot-BIND-HOWTO(1).pdf

Chroot−BIND HOWTO

Table of Contents

Chroot−BIND HOWTO. ....................................................................................................................................1

Scott Wunsch, scott at wunsch.org. .........................................................................................................1

1. Introduction. .........................................................................................................................................1

2. Preparing the Jai.. ................................................................................................................................1

3. Compiling and Installing Your Shiny New BIND. ..............................................................................1

4. Installing Your Shiny New BIND.. ......................................................................................................1

5. The End. ...............................................................................................................................................1

6. Appendix − Upgrading BIND Later. ...................................................................................................2

7. Appendix − Thanks. .............................................................................................................................2

8. Appendix − Document Distribution Policy. ........................................................................................2

1. Introduction. .........................................................................................................................................2

1.1 What?. ................................................................................................................................................2

1.2 Why?. .................................................................................................................................................2

1.3 Where?. .............................................................................................................................................3

1.4 How?. .................................................................................................................................................3

1.5 Disclaimer. .........................................................................................................................................3

2. Preparing the Jai.. ................................................................................................................................3

2.1 Creating a User. .................................................................................................................................4

2.2 Directory Structure.. ...........................................................................................................................4

2.3 Placing the BIND Data. .....................................................................................................................4

2.4 System Support Files. ........................................................................................................................5

2.5 Logging. ............................................................................................................................................5

The Ideal Solution. ......................................................................................................................6

The Other Solutions. ...................................................................................................................7

2.6 Tightening Permissions.. ...................................................................................................................7

3. Compiling and Installing Your Shiny New BIND.. ............................................................................7

3.1 Doing the Compile. ............................................................................................................................7

4. Installing Your Shiny New BIND. ......................................................................................................8

4.1 Installing the Binaries. .......................................................................................................................8

4.2 Setting up the Init Script. ...................................................................................................................8

4.3 Configuration Changes. ...................................................................................................................10

5. The End. .............................................................................................................................................10

5.1 Launching BIND. .............................................................................................................................10

5.2 That's It!. ..........................................................................................................................................10

6. Appendix − Upgrading BIND Later. ................................................................................................10

7. Appendix − Thanks. ..........................................................................................................................11

8. Appendix − Document Distribution Policy. .....................................................................................11

Chroot−BIND HOWTO

Scott Wunsch, scott at wunsch.org

v1.5, 1 December 2001

This document describes installing the BIND 9 nameserver to run in a chroot jail and as a non−root user, to

provide added security and minimise the potential effects of a security compromise. Note that this document

has been updated for BIND 9; if you still run BIND 8, you want the Chroot−BIND8 HOWTO instead.

1. Introduction

· 1.2 Why?

1.1 What?

· 1.3 Where?

· 1.4 How?

· 1.5 Disclaimer

2. Preparing the Jail

· 2.2 Directory Structure

2.1 Creating a User

· 2.3 Placing the BIND Data

· 2.4 System Support Files

· 2.5 Logging

· 2.6 Tightening Permissions

3. Compiling and Installing Your Shiny New BIND

3.1 Doing the Compile

4. Installing Your Shiny New BIND

· 4.2 Setting up the Init Script

4.1 Installing the Binaries

· 4.3 Configuration Changes

5. The End

· 5.2 That's It!

5.1 Launching BIND

Chroot−BIND HOWTO

Chroot−BIND HOWTO

6. Appendix − Upgrading BIND Later

7. Appendix − Thanks

8. Appendix − Document Distribution Policy

1. Introduction

This is the Chroot−BIND HOWTO; see Where? for the master site, which contains the latest copy. It is

assumed that you already know how to configure and use BIND (the Berkeley Internet Name Domain). If

not, I would recommend that you read the DNS HOWTO first. It is also assumed that you have a basic

familiarity with compiling and installing software on your UNIX−like system.

1.1 What?

This document describes some extra security precautions that you can take when you install BIND. It

explains how to configure BIND so that it resides in a ``chroot jail,'' meaning that it cannot see or access files

outside its own little directory tree. We shall also configure it to run as a non−root user.

The idea behind chroot is fairly simple. When you run BIND (or any other process) in a chroot jail, the

process is simply unable to see any part of the filesystem outside the jail. For example, in this document, we'll

set BIND up to run chrooted to the directory /chroot/named . Well, to BIND, the contents of this

directory will appear to be / , the root directory. Nothing outside this directory will be accessible to it. You've

probably encounted a chroot jail before, if you've ever used ftp to log into a public system.

Because the chroot process is much simpler with BIND 9, I have started to expand this document slightly, to

include more general tips about securing a BIND installation. Nevertheless, this document is not (and is not

intended to be) a complete reference for securing BIND. If you do only what is outlined in this document,

you're not finished securing your nameserver!

1.2 Why?

The idea behind running BIND in a chroot jail is to limit the amount of access any malicious individual could

gain by exploiting vulnerabilities in BIND. It is for the same reason that we run BIND as a non−root user.

This should be considered as a supplement to the normal security precautions (running the latest version,

using access control, etc.), certainly not as a replacement for them.

If you're interested in DNS security, you might also be interested in a few other products. Building BIND

with StackGuard would probably be a good idea for even more protection. Using it is easy; it's just like using

ordinary gcc. Also, DNScache is a secure replacement for BIND, written by Dan Bernstein. Dan is the author

of qmail, and DNScache appears to follow a similar philosophy.

6. Appendix − Upgrading BIND Later

Chroot−BIND HOWTO

1.3 Where?

The latest version of this document is always available from the web site of the Linux/Open Source Users of

Regina, Sask., at http://www.losurs.org/docs/howto/Chroot−BIND.html .

There is now a Japanese translation of this document, maintained by Nakano Takeo nakano at

apm.seikei.ac.jp . This is available at http://www.linux.or.jp/JF/JFdocs/Chroot−BIND−HOWTO.html .

BIND is available from the Internet Software Consortium at http://www.isc.org/bind.html . As of this writing,

the current version of BIND 9 is 9.2.0. BIND 9 has been out for some time now, and many people are using it

in production. Nevertheless, some more conservative sorts still prefer to remain with BIND 8. If you are such

a person, please see my Chroot−BIND8 HOWTO (available from the same location) for details on chrooting

it, but be warned that BIND 8 is much messier to chroot.

Keep in mind that there are known security holes in many earlier versions of BIND, so make very sure that

you're running the latest version!

1.4 How?

I wrote this document based on my experiences in setting BIND up in a chroot environment. In my case, I

already had an existing BIND installation in the form of a package that came with my Linux distribution. I'll

assume that most of you are probably in the same situation, and will simply be transferring over and

modifying the configuration files from your existing BIND installation, and then removing the package

before installing the new one. Don't remove the package yet, though; we may want some files from it first.

If this is not the case for you, you should still be able to follow this document. The only difference is that,

where I refer to copying an existing file, you first have to create it yourself. The DNS HOWTO may be

helpful for this.

1.5 Disclaimer

These steps worked for me, on my system; your mileage may vary. This is but one way to approach this;

there are other ways to set the same thing up (although the general approach will be the same). It just happens

that this was the first way that I tried that worked, so I wrote it down.

My BIND experience to date has been installing on Linux servers. However, most of the instructions in this

document should be easily applicable to other flavours of UNIX as well, and I shall try to point out

differences of which I am aware. I've also received suggestions from people using other distributions and

other platforms, and I've tried to incorporate their comments where possible.

If you run Linux, you need to make sure that you're running a 2.4 kernel before attempting this. The

−u switch (to run as a non−root user) requires this newer kernel.

2. Preparing the Jail

1.3 Where?

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: