,--- Oliver Fromme (Mon, 1 Sep 2008 15:31:07 +0200 (CEST)) ----* | Alex Goncharov wrote: | > [...] | > After this change, every time I restart `named', the ownership of the | > `master' directory is changed to `bind' -- and this is what I want: | > user `bind', I would think, should be allowed to write to this | > directory. | | No, it shouldn't. It's a security matter. If there's an | exploitable bug in BIND, an attacker could manipulate your | master zone files. That's why the bind user should *not* | be able to write to your master directory. OK, I am ready to accept this point of view and make it my starting point again (I tried, in the past). | There's no reason that the named process needs write access | to the master directory. If you use dynamic zone updates, | you should use the "dynamic" directory for those zones, | which is writable by bind. I just tried a simplistic change: a. Changed "type master" to "type dynamic" in named.conf. b. cp master/* dynamic Starting `named' with this I get: /etc/namedb/named.conf:358: 'dynamic' unexpected How do I use the `dynamic' directory? (If you know the answer -- I'll do more reading later.) OTOH, I see this example at `http://www.boran.com/security/sp/bind9_20010430.html#BM4_setting_jail_permission' -------------------- zone "test2.com" { type master; file "test2.com"; allow-update { updaters; }; }; -------------------- Which is: a. Close enough to what I have, in my original `named.conf', before a `dynamic' change attempt. b. Implies that updating a master zone is not such an unusual idea. Any comments on this? -- Alex -- alex-goncharov_at_comcast.net --Received on Mon Sep 01 2008 - 12:14:22 UTC
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:39:34 UTC