Date: Fri, 11 Jul 2008 11:56:53 -0400 From: Alan Clegg <alan@clegg.com> To: Jeremy Chadwick <koitsu@FreeBSD.org> Cc: Doug Barton <dougb@freebsd.org>, stef@memberwebs.com, "freebsd-security@freebsd.org" <freebsd-security@freebsd.org>, secteam@freebsd.org, Brett Glass <brett@lariat.net>, Remko Lodder <remko@freebsd.org>, Andrew Storms <astorms@ncircle.com> Subject: Re: [Fwd: cvs commit: ports/dns/bind9 Makefile distinfo ports/dns/bind94 Makefile distinfo ports/dns/bind95 Makefile distinfo] Message-ID: <487782C5.7050703@clegg.com> In-Reply-To: <20080711151228.GA52385@eos.sc1.parodius.com> References: <C49A67C5.1A0CBA%astorms@ncircle.com> <20080709204114.471A2F1835D@mx.npubs.com> <4876A3FE.1070407@FreeBSD.org> <200807111454.IAA18639@lariat.net> <20080711151228.GA52385@eos.sc1.parodius.com>
next in thread | previous in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jeremy Chadwick wrote: > On Fri, Jul 11, 2008 at 08:54:48AM -0600, Brett Glass wrote: >> Is there a way to restrict the ports which BIND selects -- perhaps >> at the expense of a small amount of entropy -- such that it doesn't >> try to use UDP ports which are administratively blocked (e.g. ports >> used by worms, or insecure Microsoft network utilities)? We don't >> dare turn these port blocks off, or naive users will fall prey to >> security holes in Microsoft products. But if BIND doesn't know to >> work around them, lookups will occasionally (and infuriatingly!) >> fail. > > query-source has an argument called "port" which will do what you want. > That option *only* affects UDP queries, however; TCP queries are always > random. While query-source allows you to lock down to a single port, you DO NOT WANT TO DO THIS -- if you do, you will be vulnerable to the very thing that the patch made you immune (well, safer) from. What Brett (and others) need to do is risk the waters with the new beta code (9.4.3b2 and 9.5.1b1) which includes additional "fine-grained" control for the UDP ports to be used. Please, PLEASE, do not introduce "query-source port XX" into your configurations. AlanC -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD4DBQFId4LEcKpYUrUDCYcRAiowAJ47bCASBmTszN8A7d1MbEvB9ZJq0wCWMZIK t8Uv4q/ro3MDpEP71GqtHg== =+SwG -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?487782C5.7050703>