Date: Mon, 01 Sep 2008 09:58:17 -0400 From: Alex Goncharov <alex-goncharov@comcast.net> To: freebsd-current@FreeBSD.ORG, Alex Goncharov <alex-goncharov@comcast.net> Cc: freebsd-current@FreeBSD.ORG, alex-goncharov@comcast.net Subject: Re: named mystery -- error: dumping master file: master/tmp-wTjhUzoix6 Message-ID: <E1Ka9v7-0007oh-Re@daland.home> In-Reply-To: <200809011331.m81DV7pq094904@lurza.secnetix.de> (message from Oliver Fromme on Mon, 1 Sep 2008 15:31:07 %2B0200 (CEST)) References: <200809011331.m81DV7pq094904@lurza.secnetix.de>
next in thread | previous in thread | raw e-mail | index | archive | help
,--- Oliver Fromme (Mon, 1 Sep 2008 15:31:07 +0200 (CEST)) ----* | Alex Goncharov wrote: | > [...] | > After this change, every time I restart `named', the ownership of the | > `master' directory is changed to `bind' -- and this is what I want: | > user `bind', I would think, should be allowed to write to this | > directory. | | No, it shouldn't. It's a security matter. If there's an | exploitable bug in BIND, an attacker could manipulate your | master zone files. That's why the bind user should *not* | be able to write to your master directory. OK, I am ready to accept this point of view and make it my starting point again (I tried, in the past). | There's no reason that the named process needs write access | to the master directory. If you use dynamic zone updates, | you should use the "dynamic" directory for those zones, | which is writable by bind. I just tried a simplistic change: a. Changed "type master" to "type dynamic" in named.conf. b. cp master/* dynamic Starting `named' with this I get: /etc/namedb/named.conf:358: 'dynamic' unexpected How do I use the `dynamic' directory? (If you know the answer -- I'll do more reading later.) OTOH, I see this example at `http://www.boran.com/security/sp/bind9_20010430.html#BM4_setting_jail_permission' -------------------- zone "test2.com" { type master; file "test2.com"; allow-update { updaters; }; }; -------------------- Which is: a. Close enough to what I have, in my original `named.conf', before a `dynamic' change attempt. b. Implies that updating a master zone is not such an unusual idea. Any comments on this? -- Alex -- alex-goncharov@comcast.net --
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?E1Ka9v7-0007oh-Re>