Date: Fri, 11 Jul 2008 08:54:48 -0600 From: Brett Glass <brett@lariat.net> To: Doug Barton <dougb@freebsd.org>, stef@memberwebs.com Cc: "freebsd-security@freebsd.org" <freebsd-security@freebsd.org>, Remko Lodder <remko@freebsd.org>, secteam@freebsd.org, Andrew Storms <astorms@ncircle.com> Subject: Re: [Fwd: cvs commit: ports/dns/bind9 Makefile distinfo ports/dns/bind94 Makefile distinfo ports/dns/bind95 Makefile distinfo] Message-ID: <200807111454.IAA18639@lariat.net> In-Reply-To: <4876A3FE.1070407@FreeBSD.org> References: <C49A67C5.1A0CBA%astorms@ncircle.com> <20080709204114.471A2F1835D@mx.npubs.com> <4876A3FE.1070407@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Is there a way to restrict the ports which BIND selects -- perhaps at the expense of a small amount of entropy -- such that it doesn't try to use UDP ports which are administratively blocked (e.g. ports used by worms, or insecure Microsoft network utilities)? We don't dare turn these port blocks off, or naive users will fall prey to security holes in Microsoft products. But if BIND doesn't know to work around them, lookups will occasionally (and infuriatingly!) fail. --Brett Glass At 06:06 PM 7/10/2008, Doug Barton wrote: >First off, to those who were kind enough to offer thanks, "you're >welcome." :) > >Second, one user wrote me privately to indicate that my statement in >the first paragraph of my commit message was not clear. The point to >this change is that for _each_ outgoing query a _new, random_ UDP >source port is used, _as well as_ the standard query ID. (This is of >course assuming that you do not have a port locked down in named.conf, >which no one should at this point unless firewall rules outside of >your control mandate it.) However, named is still picking a "random" >UDP port on startup and locking it down (2 if you're also using IPv6) >although it's not immediately clear to me why (I do have a query as to >the reason in progress).
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200807111454.IAA18639>