Date: Thu, 10 Jul 2008 17:06:22 -0700 From: Doug Barton <dougb@FreeBSD.org> To: stef@memberwebs.com Cc: "freebsd-security@freebsd.org" <freebsd-security@freebsd.org>, Remko Lodder <remko@freebsd.org>, secteam@freebsd.org, Andrew Storms <astorms@ncircle.com> Subject: Re: [Fwd: cvs commit: ports/dns/bind9 Makefile distinfo ports/dns/bind94 Makefile distinfo ports/dns/bind95 Makefile distinfo] Message-ID: <4876A3FE.1070407@FreeBSD.org> In-Reply-To: <20080709204114.471A2F1835D@mx.npubs.com> References: <C49A67C5.1A0CBA%astorms@ncircle.com> <20080709204114.471A2F1835D@mx.npubs.com>
next in thread | previous in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 First off, to those who were kind enough to offer thanks, "you're welcome." :) Second, one user wrote me privately to indicate that my statement in the first paragraph of my commit message was not clear. The point to this change is that for _each_ outgoing query a _new, random_ UDP source port is used, _as well as_ the standard query ID. (This is of course assuming that you do not have a port locked down in named.conf, which no one should at this point unless firewall rules outside of your control mandate it.) However, named is still picking a "random" UDP port on startup and locking it down (2 if you're also using IPv6) although it's not immediately clear to me why (I do have a query as to the reason in progress). Stef wrote: | Thanks! | | Here are simple steps to use this instead of the base named (and easily | go back later): | | # cd /usr/ports/dns/bind9 Actually I'd at least use bind94, and preferably bind95. Either of those two will have better memory management characteristics than the 9.3.x that is in dns/bind9. | # make && make install | # ln -s /etc/namedb/named.conf /usr/local/etc/named.conf You will also need to do the same with the rndc.key file, and if you are running in the chroot (the default for the rc.d script) then you will need to create /var/named/usr/local/etc and repeat the exercise for both files. | # echo 'named_program="/usr/local/sbin/named" >> /etc/rc.conf Personally my preference would be to edit the rc.conf[.local] file. | # /etc/rc.d/named restart I would actually do 'rndc stop' first, then '/etc/rc.d/named start' but for most purposes the differences there would be minor. You can also use the "replace base bind" option in the 'make config' step which would obviate editing named_program above. If you do that, add 'WITHOUT_BIND= yes' in /etc/src.conf for 7 or 8, and 'NO_BIND= yes' in /etc/make.conf in 6. hope this helps, Doug - -- ~ This .signature sanitized for your protection -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (FreeBSD) iEYEAREDAAYFAkh2o/4ACgkQyIakK9Wy8PurfQCfeN7Vvme3PABgFWMPhQz1Kgu6 gVUAni9iCNt0Gzi2YntV6uQmmRI8MhQl =4Blu -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4876A3FE.1070407>