From owner-freebsd-security Mon Apr 22 7:16:47 2002 Delivered-To: freebsd-security@freebsd.org Received: from d188h80.mcb.uconn.edu (d188h80.mcb.uconn.edu [137.99.188.80]) by hub.freebsd.org (Postfix) with SMTP id 561A237B425 for ; Mon, 22 Apr 2002 07:16:43 -0700 (PDT) Received: (qmail 46959 invoked by uid 1001); 22 Apr 2002 14:03:01 -0000 Date: Mon, 22 Apr 2002 10:03:01 -0400 From: "Peter C. Lai" To: Mario Lobo Cc: freebsd-security@freebsd.org Subject: Re: DNS Question Message-ID: <20020422100301.A46936@cowbert.2y.net> Reply-To: peter.lai@uconn.edu References: <3CC3C250.28097.2D5EA4@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <3CC3C250.28097.2D5EA4@localhost>; from Mlobo@ear.com.br on Mon, Apr 22, 2002 at 07:57:08AM -0300 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Bind has a notorious security track record. Are you running named in a jail? If you can't do that, at least run it chrooted in a sandbox. http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/dns.html has some basic basic methods of locking it down. On Mon, Apr 22, 2002 at 07:57:08AM -0300, Mario Lobo wrote: > Hi; > > I have a DNS (named) server running on a FreeBSD 4.4 box firewall. > > ipfw allows queries to ports 53 and 1024 from any IP inside the private > network (internal interface) and only certain ISP IPs on the external > interface. > > I need to open those ports to any IP on the external interface. > > Is there any security concerns I should have if I do this ? The only > services I have running are ssh (restricted to specific IPs) and squid > (local only). > > Thanks, - > *** Mario Lobo > *** Dean of Computer Department > *** American School of Recife > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message -- Peter C. Lai University of Connecticut Dept. of Residential Life | Programmer Dept. of Molecular and Cell Biology | Undergraduate Research Assistant http://cowbert.2y.net/ 860.427.4542 (Room) 860.486.1899 (Lab) 203.206.3784 (Cellphone) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message