Date: Sat, 12 Jul 2008 14:49:17 +1000 (EST) From: Ian Smith <smithi@nimnet.asn.au> To: Mark Andrews <Mark_Andrews@isc.org> Cc: Doug Barton <dougb@freebsd.org>, stef@memberwebs.com, "freebsd-security@freebsd.org" <freebsd-security@freebsd.org>, secteam@freebsd.org, Brett Glass <brett@lariat.net>, Remko Lodder <remko@freebsd.org>, Andrew Storms <astorms@ncircle.com> Subject: Re: [Fwd: cvs commit: ports/dns/bind9 Makefile distinfo ports/dns/bind94 Makefile distinfo ports/dns/bind95 Makefile distinfo] Message-ID: <Pine.BSF.3.96.1080712144107.18279B-100000@gaia.nimnet.asn.au> In-Reply-To: <200807112219.m6BMJmLg042450@drugs.dv.isc.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 12 Jul 2008, Mark Andrews wrote:
>
> > Is there a way to restrict the ports which BIND selects -- perhaps
> > at the expense of a small amount of entropy -- such that it doesn't
> > try to use UDP ports which are administratively blocked (e.g. ports
> > used by worms, or insecure Microsoft network utilities)? We don't
> > dare turn these port blocks off, or naive users will fall prey to
> > security holes in Microsoft products. But if BIND doesn't know to
> > work around them, lookups will occasionally (and infuriatingly!)
> > fail.
>
> % grep avoid doc/misc/options
> avoid-v4-udp-ports { <port>; ... };
> avoid-v6-udp-ports { <port>; ... };
> %
This seems to imply that you can't specify ranges of UDP ports to avoid
here. For example perhaps, the range traceroute uses ..
Doug responded with a new option for a range of ports to use, but an
intersection of ports to use and ^ports to avoid, including range(s),
would cover all the bases ..
cheers, Ian
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.96.1080712144107.18279B-100000>