From owner-freebsd-net@FreeBSD.ORG Wed Dec 27 19:17:05 2006 Return-Path: X-Original-To: net@freebsd.org Delivered-To: freebsd-net@FreeBSD.ORG Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id DFD9716A403 for ; Wed, 27 Dec 2006 19:17:05 +0000 (UTC) (envelope-from dougb@FreeBSD.org) Received: from mail2.fluidhosting.com (mx21.fluidhosting.com [204.14.89.4]) by mx1.freebsd.org (Postfix) with SMTP id 78F2313C46E for ; Wed, 27 Dec 2006 19:17:05 +0000 (UTC) (envelope-from dougb@FreeBSD.org) Received: (qmail 5900 invoked by uid 399); 27 Dec 2006 18:50:25 -0000 Received: from localhost (HELO ?192.168.0.5?) (dougb@dougbarton.us@127.0.0.1) by localhost with SMTP; 27 Dec 2006 18:50:25 -0000 X-Originating-IP: 127.0.0.1 Message-ID: <4592C06F.6080106@FreeBSD.org> Date: Wed, 27 Dec 2006 10:50:23 -0800 From: Doug Barton Organization: http://www.freebsd.org/ User-Agent: Thunderbird 1.5.0.8 (X11/20061215) MIME-Version: 1.0 To: "Eugene M. Kim" References: <4592AED6.4040508@ab.ote.we.lv> In-Reply-To: <4592AED6.4040508@ab.ote.we.lv> X-Enigmail-Version: 0.94.1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: net@freebsd.org Subject: Re: BIND running setuid with interface changes X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Dec 2006 19:17:06 -0000 Eugene M. Kim wrote: > Greetings, > > I am running a VPN gateway, where interfaces come and go frequently. I > set up BIND so that it listens on all interfaces. > It seems that, instead of listening on a wildcard IPv4 address (*:53, > that is), BIND monitors for address changes on all interfaces and > creates a separate listening socket for each address (note that IPv6 > uses the wildcard address, but IPv4 does not): I suspect that you are using something like "listen-on-v6 { any; };" in which case this is normal behavior. > Then, when a new address comes up (such as on a dynamically created L2TP > tun(4) interface), BIND tries to listen on it, but fails because it is > running setuid as bind: That is also normal behavior. > The only workarounds that I can think of is either to run BIND as setuid > root, or to restart (not reload) BIND every time a new VPN connection > comes up, both of which I am not comfortable with. > > Any better ideas? Nope, sorry. That is how it works. Doug -- This .signature sanitized for your protection