Public SourceMage Discussion List

[elaine <elaine AT fwsystems.com>]

Looks good.

I just have some comments on the chroot part. Obviously I can't cast
this to test so I may be missing some things.


1. at least on OpenBSD running named in chroot() requires syslogd to have
priorly created dev/log socket inside the chroot. e.g.:

syslogd -a /var/named/dev/log


2.  chown  -R  bind:bind  /etc/bind 

This probably gives write permission to the daemon on files it should *not* 
be able to such as etc/rndc.key, etc/named.conf


3. mknod creation of dev/random inside the chroot.

Unless your named is actually making use of the entropy pool I would
call this a bad idea. 

If the daemon were compromised, this would permit the attacker to target
the entropy pool, that is at least a DOS potential and at worst could
degrade the security of say sshd.

(I'm not sure it would even be desirable to create dev/urandom as the last
I looked that device will also deplete the pool, but provides pseudo-random
bits after /dev/random blocks for reading.)


elaine

On Fri, 19 Sep 2003 03:51:57 -0700 (PDT) (unchecked - local sync NTPstrat4)
Seth Woolley <seth AT tautology.org> did inscribe thusly:

> 
> Please test it.  To prevent DOS attacks on /etc/ I had it move the config
> and the chroot dir over to /var/chroot/bind which has a symlink
> from /etc/bind.  there's a symlink from /etc/bind/etc/bind back to / so
> that chrooting doesn't require a modification to the config (just remove
> the -t /etc/bind from the init script to make it not chroot).