Providing practical examples since 1998
Upgrade your DNS server – bind8 security issues
DNS, Security Add comments
This article shows how I upgraded bind8. Now that bind8 is included in the base installation of FreeBSD, this article may not be the best way to upgrade. Instead, I recommend that you read installing bind8 from ports.
WARNING: The rest of this article should be considered to be outdated.
Well, like most upgrades, it's because of security. The latest bind (bind-8.2.2.p5) fixes a few security holes. For most of us, the holes are unlikely to be encountered. But it's safer to upgrade. See the following URL for more information on the vulnerabilities this upgrade fixes:
http://www.isc.org/products/BIND/bind-security-19991108.html
The install
Since I have the entire ports tree installed, all I needed to do was:
cd /usr/ports/net/bind8
This was slightly interesting. The new named (the executable program for bind) installed at /usr/local/sbin/named but my existing version was at /usr/sbin/named. But this was easily changed.
I modified /etc/rc.conf to reflect the new location:
named_program="/usr/local/sbin/named"
I was already running named. Here are the entries from my /etc/rc.conf which relate to named:
named_enable="YES"
named_flags="-u bind -g bind"
The flags passed to named specify the user and the group under which named should run. This places named in a sandbox which increases the security of named. It makes it harder for people to break into your system if an exploit is found with named. Just be sure you don't give any real access rights to the user and group under which named runs. FreeBSD after 3.3 (I think) include the user id and group bind by default so you don't have to create them.
Starting the new named
First, I killed the existing named:
killall -QUIT named
Then I started the new named:
/usr/local/sbin/named
The logs
Checking the logs I found this:
Nov 20 05:34:01 ducky named[53387]: starting.  named 8.2.2-P5
Sat Nov 20 05:07:59 NZDT 1999
root@ducky.nz.freebsd.org:/usr/ports/net/bind8/work/src/bin/named
Nov 20 05:34:02 ducky named[53387]: hint zone "" (IN) loaded
(serial 0)
Nov 20 05:34:02 ducky named[53387]: Zone "0.0.127.IN-ADDR.ARPA"
(file localhost.rev): No default TTL set using SOA
minimum instead
Nov 20 05:34:02 ducky named[53387]: master zone
"0.0.127.IN-ADDR.ARPA" (IN) loaded (serial 199907090)
You can see that the correct version of named (8.2.2-P5) is running and the date it was compiled (Sat Nov 20 05:07:59 NZDT 1999).
The messages which refer to a lack of a default TTL can be safely ignored. TTL = time to live. It dictates how long a server can cache information about your box. The message in question is named merely telling you politely that your zone files don't contain a default TTL. You can specify the default TTL like this:
$TTL    345600
Put that at the top of each of your zone files and those messages will go away. This value will be used for each host for which a TTL value is not explicitly assigned. In the above case, the default TTL is 4 days as recommended in RFC 1537 This will apply to each host within the zone.
Custom TTL values can be assigned to individual hosts. This is done like this:
1       3600 IN      PTR     localhost.yourdomain.org.
For more information, I suggest you buy a copy of DNS and Bind. It's a very useful book when you're doing anything with a DNS server. That's how I found how what this message was all about. See p189 for an explanation of how you can use TTL to your advantage when moving or renaming boxes.
Posted by Dan Langille at 12:00 am
Dynamic DNS problems prompt move to cucipop watch – making it work
Dan Langille on This is the article title
MartynHill on Creating your own Certificate Authority
Taz on Stripping ^M from your files
Dan Langille on Bacula – copying a job; doing it better
mistige on Bacula – copying a job; doing it better
Archives Select Month October 2012 (1) June 2012 (1) February 2012 (1) August 2011 (1) February 2011 (1) January 2011 (1) December 2010 (1) November 2010 (5) October 2010 (2) September 2010 (3) August 2010 (3) March 2010 (1) January 2010 (4) December 2009 (1) November 2009 (5) October 2009 (2) December 2008 (1) November 2008 (3) October 2008 (1) August 2008 (1) July 2008 (1) June 2008 (1) March 2008 (2) December 2007 (2) September 2007 (1) August 2007 (2) July 2007 (2) March 2007 (1) February 2007 (1) January 2007 (2) December 2006 (1) November 2006 (1) August 2006 (6) July 2006 (6) June 2006 (5) May 2006 (3) April 2006 (2) March 2006 (2) February 2006 (4) January 2006 (1) December 2005 (3) October 2005 (1) September 2005 (2) August 2005 (2) July 2005 (1) April 2005 (1) January 2005 (1) December 2004 (2) September 2004 (2) July 2004 (1) June 2004 (4) May 2004 (3) April 2004 (1) February 2004 (1) January 2004 (7) December 2003 (1) September 2003 (1) August 2003 (1) July 2003 (1) May 2003 (3) April 2003 (2) March 2003 (4) February 2003 (1) January 2003 (3) December 2002 (1) November 2002 (2) October 2002 (3) September 2002 (4) August 2002 (2) July 2002 (2) April 2002 (3) March 2002 (1) February 2002 (2) January 2002 (4) December 2001 (5) November 2001 (4) September 2001 (3) August 2001 (3) July 2001 (2) June 2001 (4) May 2001 (6) April 2001 (8) March 2001 (9) February 2001 (8) January 2001 (3) December 2000 (16) November 2000 (10) October 2000 (13) September 2000 (13) August 2000 (11) July 2000 (14) June 2000 (8) May 2000 (15) April 2000 (18) March 2000 (16) February 2000 (8) January 2000 (40) December 1999 (16) November 1999 (23) October 1999 (5) September 1999 (1) August 1999 (16) July 1999 (12) June 1999 (10) May 1999 (7) April 1999 (11) March 1999 (25) February 1999 (23) January 1999 (30) December 1998 (3) November 1998 (9) October 1998 (17) September 1998 (9) August 1998 (17) July 1998 (12) June 1998 (2) May 1998 (1) February 1998 (1)
About this site Advocacy Apache Backups Bacula CD-ROM Conventions cvsup databases Disks DNS File Systems Firewalls/Gateways FreeBSD FrontPage ftp Installation IP Filter Jails Kernels Laptops Mail Mailing Lists Majordomo mySQL NAT Networks New Computers NFS Non-related topics Opteron Ports Postfix PostgreSQL PPP RAID samba Security Shells, ssh System upgrades Time sychronization Uncategorized Upgrades Windows
© 2015 Dan Langille Suffusion theme by Sayontan Sinha