Date: Sat, 22 Jan 2005 17:43:28 -0800 (PST) From: Doug Barton <DougB@FreeBSD.org> To: nikolay.nenchev@rbb-sofia.raiffeisen.at Cc: freebsd-current@freebsd.org Subject: Re: Bind 9.3 rndc? Message-ID: <20050122173911.F2903@ync.qbhto.arg> In-Reply-To: <OF1CBC4F89.03518929-ON42256F8E.002BE44A-42256F8E.002CA49C@mdcs.at> References: <OF1CBC4F89.03518929-ON42256F8E.002BE44A-42256F8E.002CA49C@mdcs.at>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 19 Jan 2005 nikolay.nenchev@rbb-sofia.raiffeisen.at wrote:
> Hi,
> have installed FreeBSD 5.3 with Bind integrated in it. named is running in
> chroot, with user bind, so every file in /etc/namedb is owned by
> bind:wheel, exept rndc.key. (i have also rndc.conf with owner bind)
With the new structure for BIND in FreeBSD 5.3 and later, you don't need
rndc.conf, and in fact, you probably shouldn't have one unless you have
a super-compelling need. The rndc.key file is all you need for basic
operation, and the rc.d/named file will create it for you.
> and it is impossible to start make rndc reload. if i change owner on
> rndc.key it is working but is it a security issue, user who is running
> named (bind) to have acceess to rndc.key.
Someone else already pointed out that it's necessary to have the
rndc.key file owned by the same user as named, and it's not really a
security threat.
> A another thing, if i make " sudo named stop/start" the own of my master
> folder is change to root:wheel (before bind:wheel)?
That's because the rc.d script runs mtree to make sure that the
permissions are correct on the files in /var/named. This is actualy one
area where the security issues are relevant, in the sense that if an
attacker compromises the named user you don't want them to be able to
alter your master zone files.
Hope this helps,
Doug
--
This .signature sanitized for your protection
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050122173911.F2903>