Date: Fri, 11 Jul 2008 08:12:28 -0700 From: Jeremy Chadwick <koitsu@FreeBSD.org> To: Brett Glass <brett@lariat.net> Cc: Doug Barton <dougb@freebsd.org>, stef@memberwebs.com, "freebsd-security@freebsd.org" <freebsd-security@freebsd.org>, secteam@freebsd.org, Remko Lodder <remko@freebsd.org>, Andrew Storms <astorms@ncircle.com> Subject: Re: [Fwd: cvs commit: ports/dns/bind9 Makefile distinfo ports/dns/bind94 Makefile distinfo ports/dns/bind95 Makefile distinfo] Message-ID: <20080711151228.GA52385@eos.sc1.parodius.com> In-Reply-To: <200807111454.IAA18639@lariat.net> References: <C49A67C5.1A0CBA%astorms@ncircle.com> <20080709204114.471A2F1835D@mx.npubs.com> <4876A3FE.1070407@FreeBSD.org> <200807111454.IAA18639@lariat.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Jul 11, 2008 at 08:54:48AM -0600, Brett Glass wrote: > Is there a way to restrict the ports which BIND selects -- perhaps > at the expense of a small amount of entropy -- such that it doesn't > try to use UDP ports which are administratively blocked (e.g. ports > used by worms, or insecure Microsoft network utilities)? We don't > dare turn these port blocks off, or naive users will fall prey to > security holes in Microsoft products. But if BIND doesn't know to > work around them, lookups will occasionally (and infuriatingly!) > fail. query-source has an argument called "port" which will do what you want. That option *only* affects UDP queries, however; TCP queries are always random. -- | Jeremy Chadwick jdc at parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, USA | | Making life hard for others since 1977. PGP: 4BD6C0CB |
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080711151228.GA52385>