Date: Wed, 27 Dec 2006 09:35:18 -0800 From: "Eugene M. Kim" <freebsd.org@ab.ote.we.lv> To: net@freebsd.org Subject: BIND running setuid with interface changes Message-ID: <4592AED6.4040508@ab.ote.we.lv>
next in thread | raw e-mail | index | archive | help
Greetings, I am running a VPN gateway, where interfaces come and go frequently. I set up BIND so that it listens on all interfaces. It seems that, instead of listening on a wildcard IPv4 address (*:53, that is), BIND monitors for address changes on all interfaces and creates a separate listening socket for each address (note that IPv6 uses the wildcard address, but IPv4 does not): home 09:22:27 namedb # 61 sockstat|grep 'named.*:53' bind named 38200 20 udp6 *:53 *:* bind named 38200 21 tcp6 *:53 *:* bind named 38200 22 udp4 10.0.0.1:53 *:* bind named 38200 23 tcp4 10.0.0.1:53 *:* bind named 38200 24 udp4 127.0.0.1:53 *:* bind named 38200 25 tcp4 127.0.0.1:53 *:* home 09:25:12 namedb # 62 Then, when a new address comes up (such as on a dynamically created L2TP tun(4) interface), BIND tries to listen on it, but fails because it is running setuid as bind: Dec 27 02:32:00 home named[1121]: listening on IPv4 interface tun0, 10.0.2.129#53 Dec 27 02:32:00 home named[1121]: could not listen on UDP socket: permission denied The only workarounds that I can think of is either to run BIND as setuid root, or to restart (not reload) BIND every time a new VPN connection comes up, both of which I am not comfortable with. Any better ideas? Cheers, Eugene
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4592AED6.4040508>