Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] bind 9.2.2-P1 w/ delegation-only and chrooting in devel and test

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: elaine <elaine AT fwsystems.com>
  • To: Seth Woolley <seth AT tautology.org>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] bind 9.2.2-P1 w/ delegation-only and chrooting in devel and test
  • Date: Fri, 19 Sep 2003 12:33:46 -0400


Looks good.

I just have some comments on the chroot part. Obviously I can't cast
this to test so I may be missing some things.


1. at least on OpenBSD running named in chroot() requires syslogd to have
priorly created dev/log socket inside the chroot. e.g.:

syslogd -a /var/named/dev/log


2. chown -R bind:bind /etc/bind

This probably gives write permission to the daemon on files it should *not*
be able to such as etc/rndc.key, etc/named.conf


3. mknod creation of dev/random inside the chroot.

Unless your named is actually making use of the entropy pool I would
call this a bad idea.

If the daemon were compromised, this would permit the attacker to target
the entropy pool, that is at least a DOS potential and at worst could
degrade the security of say sshd.

(I'm not sure it would even be desirable to create dev/urandom as the last
I looked that device will also deplete the pool, but provides pseudo-random
bits after /dev/random blocks for reading.)


elaine

On Fri, 19 Sep 2003 03:51:57 -0700 (PDT) (unchecked - local sync NTPstrat4)
Seth Woolley <seth AT tautology.org> did inscribe thusly:

>
> Please test it. To prevent DOS attacks on /etc/ I had it move the config
> and the chroot dir over to /var/chroot/bind which has a symlink
> from /etc/bind. there's a symlink from /etc/bind/etc/bind back to / so
> that chrooting doesn't require a modification to the config (just remove
> the -t /etc/bind from the init script to make it not chroot).




Archive powered by MHonArc 2.6.24.

Top of Page