Security bugs are reported here via bugzilla

[Seth Woolley <seth AT tautology.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Please test it.  To prevent DOS attacks on /etc/ I had it move the config
and the chroot dir over to /var/chroot/bind which has a symlink
from /etc/bind.  there's a symlink from /etc/bind/etc/bind back to / so
that chrooting doesn't require a modification to the config (just remove
the -t /etc/bind from the init script to make it not chroot).

There's a new config layout, too.  master and slave zones have their own
directories and config files (mkzones.sh is a tool to create the
zones.conf and szones.conf files which are included in named.conf), and
make sure to put your options in options.conf. That allows us to change
around defaults easily with just an update and makes my scripting easier.
Hope nobody minds, I like it this way better.

And it grabs the root zone if it can connect to internic for
use in with the delegation-only.  It also generates the named.root from
dig . ns automatically if it can do that.  It automatically backs up your
config (I hope) and puts it into the new chroot directory as well...  but
it's still in test for your testing pleasure.  The slave zone it creates
can be copied to another copy of smgl bind in one easy step to have a
slave setup.  localhost.rev is auto-generated as well if it doesn't exist.

All TLDs are set to delegation-only by default, to prevent the dozen or so
CC and G TLDs from using wildcard results to siphon off typo hits:

http://isc.org/products/BIND/delegation-only.html

All future BIND releases will contain the patch from the sound of it.  No
need to null route their IP anymore or use the hosts file:

route add 64.94.110.11 reject
(or I think:, /etc/hosts:64.94.110.11 0.0.0.0)

zone ".com" { type: delegation-only; };

$ host lfkjdslfjlsfajsfl.com 4.2.2.1
lfkjdslfjlsfajsfl.com   A       64.94.110.11
$ host lfkjdslfjlsfajsfl.com 65.102.47.193
lfkjdslfjlsfajsfl.com does not exist at ns0.positivism.org, try again

works like a charm, but to be honest, you need to make a list to be complete:

# modified from some url I don't remember... original used curl and ipget and 
printed out the returned IP
for dom in `wget -O - --passive ftp://ftp.internic.net/domain/root.zone.gz 2> 
/dev/null | gunzip -c | grep NS | awk '{print $1}' | uniq | egrep 
"^[^\.]*\.$"`; do
        host "*.$dom" > /dev/null 2> /dev/null && echo zone '"'$dom'"' '{ 
type delegation-only; };'
done

zone "MUSEUM." { type delegation-only; };
zone "AC." { type delegation-only; };
zone "BZ." { type delegation-only; };
zone "CN." { type delegation-only; };
zone "COM." { type delegation-only; };
zone "CX." { type delegation-only; };
zone "MP." { type delegation-only; };
zone "NET." { type delegation-only; };
zone "NU." { type delegation-only; };
zone "PH." { type delegation-only; };
zone "PW." { type delegation-only; };
zone "SH." { type delegation-only; };
zone "TD." { type delegation-only; };
zone "TK." { type delegation-only; };
zone "TM." { type delegation-only; };
zone "TW." { type delegation-only; };
zone "WS." { type delegation-only; };
zone "CC." { type delegation-only; };

Seth
- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (FreeBSD)

iD8DBQE/at/R7fQ833vqzH0RAkWCAKDOiHq+g2zYCJXn62PHfhH1/igP8QCgnetB
sbYeF3f9s+oZ0r2r0ICp4/0=
=xzYo
-----END PGP SIGNATURE-----