OpenBSD Journal

Privilege seperation for named

Contributed by jose on from the safer-DNS dept.

jtorin writes: "Can Erkin Acar writes in http://marc.theaimsgroup.com/?l=openbsd-cvs&m=107911697602532&w=2
Privilege seperation for named. Allows named to handle address/interface changes without restart. If you use non-standard ports in named configuration make sure they are > 1024. Also /var/named/etc/rndc.key (if any) must be readable by group named.

Initial work and testing by itojun@, jakob@, hints, help from henning@, avsm@, beck@. ok henning, beck, avsm, deraadt

(Comments are closed)

Comments

  1. By Anonymous Coward () on

    What special steps do I have to take if I want to update? What permissions do I have to change to keep named running? Or should I just wait until the upgrade minifaq is updated?

    Comments

    1. By Can Erkin Acar () on

      Since bind already ran in chroot, under _named user, no special configuration is required. As noted in the commit message, if you are using rndc with keys defined in the file 'rndc.key' you have to make sure that your /var/named/etc/rndc.key is root:named (user:group) mode 640. If you have changed the default ports for named (53) rndc (953) or lwres (921) in named configuration, make sure you are using ports > 1024.

  2. By Anonymous Coward () on

    Ok for recursive DNS named is possible. But why NSD is not used by default for authoritative DNS ?

    Comments

    1. By Anonymous Coward () on

      Hmm...Let's see.....Maybe, because there is no fucking point in doing this????

    2. By krh () on

      NSD is, at least in comparison to named, not very common. This is the same reason that OpenBSD ships with sendmail by default instead of, say, Postfix: Everyone knows how to use named and sendmail, so OpenBSD contains no surprises and no difficulties.

      Comments

      1. By Luiz Gustavo () on

        Sorry, but doesn't make any sense at all.

        We could argue about NSD begin not audited or even the fact of not having a recursive piece to fit bind hole.

        Unfortunally ISC has a history of issues and we should note the lack of men power right now to build replacements.

        Comments

        1. By krh () on

          The web page says, "Our efforts emphasize portability, standardization, correctness, proactive security and integrated cryptography." BIND is portable and standard, and while ISC does have, as you say, a history of issues, BIND 9 has a good track record. Furthermore, by the OpenBSD team's efforts it is getting safer all the time.

          Given that, I'm comfortable and happy using BIND. If you're not, then by all means, run something else! I'd rather you did that than have you be forced to run a name server you didn't trust.

          Comments

          1. By Luiz Gustavo () on

            I'm really not much concerned about BIND9 track record, but looking the mess that they usually left behind...

            See I'm not bashing efforts taken to make bind behave better, but you must see the real reason behind it.

            BTW Bind is standard in the same way as sendmail, which seems to me a twisted one for sure.

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]