From owner-freebsd-stable  Thu Feb  1  9:17: 9 2001
Delivered-To: freebsd-stable@freebsd.org
Received: from whistle.com (s205m131.whistle.com [207.76.205.131])
	by hub.freebsd.org (Postfix) with ESMTP id 6049337B6A7
	for <stable@FreeBSD.ORG>; Thu,  1 Feb 2001 09:16:51 -0800 (PST)
Received: (from smap@localhost)
	by whistle.com (8.10.0/8.10.0) id f11HGkt15082;
	Thu, 1 Feb 2001 09:16:46 -0800 (PST)
Received: from pau-amma.whistle.com( 207.76.205.64) by whistle.com via smap (V2.0)
	id xma015078; Thu, 1 Feb 2001 09:16:20 -0800
Received: (from dhw@localhost)
	by pau-amma.whistle.com (8.11.1/8.11.1) id f11HGK503410;
	Thu, 1 Feb 2001 09:16:20 -0800 (PST)
Date: Thu, 1 Feb 2001 09:16:20 -0800 (PST)
From: David Wolfskill <dhw@whistle.com>
Message-Id: <200102011716.f11HGK503410@pau-amma.whistle.com>
To: khera@kciLink.com, stable@FreeBSD.ORG
Subject: Re: DNS security
In-Reply-To: <14969.38607.142726.115583@onceler.kciLink.com>
Sender: owner-freebsd-stable@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

>From: Vivek Khera <khera@kciLink.com>
>Date: Thu, 1 Feb 2001 12:03:11 -0500

>2) bind tries to write temporary files into the CWD.  Unfortunately,
>   /etc/namedb is root:wheel and not writable by the bind process
>   owner.  There doesn't seem to be a parameter to bind to tell it
>   where to write those files, but there is an environment variable,
>   DSTKEYPATH, that can be used.

named has a command-line argument to override the location of its
configuration file -- or you can make /etc/named.conf a symlink to the
real one.

In turn, named.conf has a directive:

options {
        directory "/etc/namedb";
	...
	};

and you may change that to suit your environemnt.  For example, my home
firewall (& external nameserver) has:

options {
        directory "/var/namedb";
	...
	};

(and /etc/named.conf is a symlink to /var/namedb/named.conf).

Cheers,
david
-- 
David Wolfskill      dhw@whistle.com   UNIX System Administrator
Desk: 650/577-7158   TIE: 8/499-7158   Cell: 650/759-0823


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message