From owner-freebsd-doc  Sat May 12  6:30: 8 2001
Delivered-To: freebsd-doc@freebsd.org
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP id 41ABF37B43E
	for <freebsd-doc@freebsd.org>; Sat, 12 May 2001 06:30:01 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.11.1/8.11.1) id f4CDU1h05561;
	Sat, 12 May 2001 06:30:01 -0700 (PDT)
	(envelope-from gnats)
Received: from blackhelicopters.org (geburah.blackhelicopters.org [209.69.178.18])
	by hub.freebsd.org (Postfix) with ESMTP id 5A9B137B43E
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 12 May 2001 06:25:38 -0700 (PDT)
	(envelope-from mwlucas@blackhelicopters.org)
Received: (from mwlucas@localhost)
	by blackhelicopters.org (8.9.3/8.9.3) id JAA32804;
	Sat, 12 May 2001 09:25:11 -0400 (EDT)
	(envelope-from mwlucas)
Message-Id: <200105121325.JAA32804@blackhelicopters.org>
Date: Sat, 12 May 2001 09:25:11 -0400 (EDT)
From: mwlucas@blackhelicopters.org
Reply-To: mwlucas@blackhelicopters.org
To: FreeBSD-gnats-submit@freebsd.org
X-Send-Pr-Version: 3.2
Subject: docs/27284: new FAQ entry
Sender: owner-freebsd-doc@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


>Number:         27284
>Category:       docs
>Synopsis:       new FAQ entry
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-doc
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Sat May 12 06:30:00 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator:     Michael Lucas
>Release:        FreeBSD 3.5-STABLE i386
>Organization:
None
>Environment:

	Bind8 attaches to an additional high port.  This gets brought
up in -security every so often, check the archives.

>Description:

	Attached is a patch to address this in a FAQ.  A committer
might want to move it to a separate section, I just took a stab at
picking a spot.

>How-To-Repeat:

	Read -security.

>Fix:

--- book.sgml-dist	Sat May 12 09:01:32 2001
+++ book.sgml	Sat May 12 09:16:06 2001
@@ -8866,6 +8866,37 @@
       </qandaentry>
 
       <qandaentry>
+        <question id="extra-named-port">
+	  <para>My named is listening on port 53 and some other
+	    high-numbered port?  Named is vulnerable a lot, have I
+	    been hacked?</para>
+	</question>
+
+	<answer>
+	  <para>No.  FreeBSD 3.0 and later use a version of named that
+	    uses a random high-numbered port for outgoing queries.  If
+	    you want to use port 53 for outgoing queries, either to
+	    get past a firewall or to make yourself feel better, you
+	    can use the following in
+	    <filename>/etc/namedb/named.conf</filename>
+
+	    <programlisting>
+	      options {
+	           query-source address * port 53;
+	      };
+	    </programlisting>
+
+	  <para>You can replace the * with a single IP address if you
+	    want to tighten things further.</para>
+
+	  <para>Congratulations, by the way.  It's good practice to
+	    read your <command>sockstat</command> output and notice
+	    odd things.</para>
+	</answer>
+      </qandaentry>
+
+
+      <qandaentry>
         <question id="bpf-not-configured">
           <para>Why do I get <literal>/dev/bpf0: device not
             configured</literal>?</para>


>Release-Note:
>Audit-Trail:
>Unformatted:

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-doc" in the body of the message