Date: Thu, 23 Aug 2001 10:52:33 -0700 (PDT) From: Matt Dillon <dillon@earth.backplane.com> To: "Brian F. Feldman" <green@FreeBSD.ORG> Cc: "Andrey A. Chernov" <ache@nagual.pp.ru>, Brian Somers <brian@Awfulhak.org>, Jun Kuriyama <kuriyama@FreeBSD.ORG>, cvs-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG, brian@freebsd-services.com Subject: Re: cvs commit: src/etc/defaults rc.conf src/etc/mtree BSD.var.dist src/etc/namedb named.conf Message-ID: <200108231752.f7NHqXE88004@earth.backplane.com> References: <200108231707.f7NH7dG14247@green.bikeshed.org>
next in thread | previous in thread | raw e-mail | index | archive | help
:For what it's worth, here's how I configure named on the computers I run.
:Not that it's the best way, but it's definitely very reasonable for a
:default if nothing else.
:
:In rc.conf I use:
:syslogd_flags="-s -l /etc/namedb/var/run/log" # Flags to syslogd (if enabled).
:named_flags="-u daemon -g daemon -t /etc/namedb -c named.conf"
There is a pre-configured 'bind' user and 'bind' group available, you
should use those. A program isn't running in a sandbox if it shares
its uid with other unrelated programs - like portmap (!) for example.
There is a standard place for bind-modifiable files (a.k.a. secondary
files), /etc/namedb/s, and comments in the default named.conf describing
how to set it up. There are comments in the default rc.conf describing
how to run named in a sandbox.
The only thing I *didn't* do was turn the sandbox on by default and
turn on the creation of /etc/namedb/s in the mtree config.
-Matt
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200108231752.f7NHqXE88004>