Date: Sat, 12 May 2001 09:25:11 -0400 (EDT) From: mwlucas@blackhelicopters.org To: FreeBSD-gnats-submit@freebsd.org Subject: docs/27284: new FAQ entry Message-ID: <200105121325.JAA32804@blackhelicopters.org>
next in thread | raw e-mail | index | archive | help
>Number: 27284
>Category: docs
>Synopsis: new FAQ entry
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-doc
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: change-request
>Submitter-Id: current-users
>Arrival-Date: Sat May 12 06:30:00 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator: Michael Lucas
>Release: FreeBSD 3.5-STABLE i386
>Organization:
None
>Environment:
Bind8 attaches to an additional high port. This gets brought
up in -security every so often, check the archives.
>Description:
Attached is a patch to address this in a FAQ. A committer
might want to move it to a separate section, I just took a stab at
picking a spot.
>How-To-Repeat:
Read -security.
>Fix:
--- book.sgml-dist Sat May 12 09:01:32 2001
+++ book.sgml Sat May 12 09:16:06 2001
@@ -8866,6 +8866,37 @@
</qandaentry>
<qandaentry>
+ <question id="extra-named-port">
+ <para>My named is listening on port 53 and some other
+ high-numbered port? Named is vulnerable a lot, have I
+ been hacked?</para>
+ </question>
+
+ <answer>
+ <para>No. FreeBSD 3.0 and later use a version of named that
+ uses a random high-numbered port for outgoing queries. If
+ you want to use port 53 for outgoing queries, either to
+ get past a firewall or to make yourself feel better, you
+ can use the following in
+ <filename>/etc/namedb/named.conf</filename>
+
+ <programlisting>
+ options {
+ query-source address * port 53;
+ };
+ </programlisting>
+
+ <para>You can replace the * with a single IP address if you
+ want to tighten things further.</para>
+
+ <para>Congratulations, by the way. It's good practice to
+ read your <command>sockstat</command> output and notice
+ odd things.</para>
+ </answer>
+ </qandaentry>
+
+
+ <qandaentry>
<question id="bpf-not-configured">
<para>Why do I get <literal>/dev/bpf0: device not
configured</literal>?</para>
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-doc" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200105121325.JAA32804>