Date: Thu, 23 Aug 2001 21:29:06 +0100 From: Brian Somers <brian@Awfulhak.org> To: Kris Kennaway <kris@obsecurity.org> Cc: "Andrey A. Chernov" <ache@nagual.pp.ru>, Jun Kuriyama <kuriyama@FreeBSD.org>, cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org, brian@freebsd-services.com Subject: Re: cvs commit: src/etc/defaults rc.conf src/etc/mtree BSD.var.dist src/etc/namedb named.conf Message-ID: <200108232029.f7NKT6g86317@hak.lan.Awfulhak.org> In-Reply-To: Message from Kris Kennaway <kris@obsecurity.org> of "Thu, 23 Aug 2001 12:40:33 PDT." <20010823124033.A90942@xor.obsecurity.org>
next in thread | previous in thread | raw e-mail | index | archive | help
>
> --huq684BweRXVnRxX
> Content-Type: text/plain; charset=us-ascii
> Content-Disposition: inline
> Content-Transfer-Encoding: quoted-printable
>
> On Thu, Aug 23, 2001 at 05:44:58PM +0400, Andrey A. Chernov wrote:
> > On Thu, Aug 23, 2001 at 06:34:46 -0700, Jun Kuriyama wrote:
> > > kuriyama 2001/08/23 06:34:46 PDT
> > >=20
> > > Modified files:
> > > etc/defaults rc.conf=20
> > > etc/mtree BSD.var.dist=20
> > > etc/namedb named.conf=20
> > > Log:
> > > Invoke named with privilege of bind:bind.
> > > Change pidfile location to /var/run/named/pid.
> >=20
> > Is it discussed or I miss something? We already have an option to run it
> > in bind sandbox, but as non-default option. Some functions not works in
> > bind sandbox, I don't remember exactly at this moment.
>
> With my security officer hat on, I support this change. It is not
> suitable for everyone because of the interface binding problem, but
> since named requires configuration before it can be used, slightly
> changing the nature of that configuration process for some people is a
> reasonable thing to do providing it's documented.
>
> It's well past time we did this, and if there's ever another remote
> hole in bind8, we'll all thank Kuriyama-san for doing it.
Bear in mind that we're also breaking existing configurations that
have ``named_enable=YES'' in /etc/rc.conf (they're now running as
bind:bind). An entry should be made in UPDATING.
> Kris
--
Brian <brian@freebsd-services.com> <brian@Awfulhak.org>
http://www.freebsd-services.com/ <brian@[uk.]FreeBSD.org>
Don't _EVER_ lose your sense of humour ! <brian@[uk.]OpenBSD.org>
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200108232029.f7NKT6g86317>