« Home

Chroot Bind 9 How to - Solaris 8

This document describes installing the BIND 9 nameserver to run in a
chroot jail and as a non-root user, to provide added security and minimise the potntial effects of a security compromise. This is for Bind 9 only and Solaris.

Michael Johnson

V1.0 DEC 28, 2002


  • Most people put this at the end but a lot of people don’t make it that far so I am putting them at the beginngin.

  • Rich Mirch Looking over my setup and commenting security and configureation.

1. Introduction

This is the Chroot-BIND HOWTO for solaris. It is assumed that you already know how to configure and use BIND (the Berkeley

Internet Name Domain). If not, please go read the DNS HOWTO and get a good understanding on DNS.

1.1 Latest version

The latest version of this can be found here!

1.2 System

The following worked on my system which is Solaris 8 one with processor.

I hope you have as much luck as I do.

1.3 Disclaimer

The contents of this document worked for myself on the systems mentioned above. I have seen a number of different setups that

work equals as well. This is just how I decided on doing it. I have only installed bind on BSD/Solaris but with slight modifications it

should be portable across the different flavors of UNIX… sometimes those slight modifications are the ones that you can’t figure out

why its not working! If you have any comments/updates please send I will update this document in a timely manner.

2 Pre-Install

2.1 Create Non-root User

Create the user you want bind to run as. I used named. This should create a named group as well.

Solaris 8

#groupadd named

#useradd named -d /usr/local/named -g named

(you might need to specify gid for both groupadd and useradd)

2.2 Create Directory Structure

I like to keep everything under /usr/local/ so mine is as follows:


+-- named


      +-- etc

      |      +--namedb

      |      +--slave



Note:other directories will be created with the configure /make


mkdir –p /usr/local/named

cd /usr/local/named

mkdir -p {dev,opt,usr,var,etc};

mkdir -p var/{run,log,named} usr/{local,lib};

mkdir -p usr/share/lib/zoneinfo;

2.3 Configure/Make/Install bind

Since we have not installed bind into our new directory structure lets do it now.


gzip -d bind-9.x.x.tar.gz

tar -xvf bind-9.x.x.tar

cd bind-9.x.x

I configured with threads if you want to go for it if not don’t.


./configure --prefix=/usr/local/named/ --enable-threads

make install

Now you should see new directories under /usr/local/named

2.4 Bind Data Files

If you already had bind installed and setup the copy the Data files from your current install to the new install path.
If you did not have bind already installed make install just put some new files into /etc.
We need to move those files from /etc and move them into our new bind home directory.
Then give the bind user we created permissions to this directory and the files in it.


cp -p /etc/named.conf /usr/local/named/etc/

cp -a /var/named/* /usr/local/named/etc/namedb/

chmod 770 /usr/local/named

cd /usr/local/named

chown –R root:named etc

chown root:named var/run

2.5 System support files

For bind to work we need certain system files.


cp -p /usr/lib/libnsl.so.1
/usr/lib/libsocket.so.1 /usr/lib/libc.so.1
/usr/lib/libdl.so.1 /usr/lib/libmp.so.2
(use ldd to find any others that might be missing)
I found these:
cp /usr/lib/ld.so.1 /usr/lib/nss_files.so.1 /usr/local/named/usr/lib

You will need files from /etc as well


cp /etc/(syslog.conf, netconfig,nsswitch.conf ,resolv.conf, TIMEZONE) /usr/local/named/etc

cp /etc/passwd /usr/local/named/etc/ (REMOVE UNNEEDED USERS)

cp /etc/group /usr/local/named/etc/ (REMOVED UNNEEDED GROUPS)

cp /etc/shadow /usr/local/named/etc/ (REMOVE AGAIN!)

We also need some time zone stuff

mkdir -p /usr/local/named/usr/share/lib/zoneinfo
cp -p /usr/share/lib/zoneinfo/MET

And devices!

cd /usr/local/named/dev

mknod tcp c 11 42

mknod udp c 11 41

mknod log c 21 5

mknod null c 13 2

mknod zero c 13 12

chgrp sys null zero

mknod conslog c 21 0

mknod syscon c 0 0

chmod 620 syscon

chgrp tty syscon

chgrp sys conslog

2.5.1 System support files security

cd /usr/local/named

chown -R root.named opt var

chmod -R g-w var

chmod -R -w opt usr

chmod -R o-rx .

chmod g+w var/run var/log

touch var/log/all.log var/run/named.pid

chown named.named var/log/all.log var/run/named.pid

find . -type f -exec chmod ug-s {} \;


2.6 Syslog Modification

Next we need to change how syslog is going to log in the chroot env.

We need to edit a few lines in out named.conf file. I keep mine in /usr/local/named/etc/namedb some people like to keep it in

/usr/local/named/etc its up to you.

Add or modify the following:


directory "/etc/namedb";

pid-file "/var/run/named.pid";

statistics-file "/var/run/named.stats";

4. Startup

4.1 Init startup script

I like to put this script into /etc/init.d/ then symlink it to rc2.d
That was it will stop and start on boot. You can do it from wherever you like to start your daemons.


# Determine the process ids of the daemons and no other processes

pids=`/bin/ps -ef | \

/bin/grep named | \

/bin/egrep -v "grep|$$|start|stop" | \

/bin/awk '{printf "%d ", $2}'`

case $1 in


if [ "$pids" = '' ] ; then

/usr/local/bin/chroot /usr/local/named /sbin/named -u named -c


echo '' 1>&2

echo 'WARNING: /etc/init.d/named.sh already running' 1>&2

echo '' 1>&2



f [ "$pids" != '' ] ; then

if [ -f /usr/local/named/var/run/named.pid ] ; then

/bin/kill -1 `/bin/cat /var/run/named.pid`

elif [ -f /var/run/named.pid ] ; then

/bin/kill -1 `/bin/cat /var/run/named.pid`


echo '' 1>&2

echo 'ERROR: missing named pid file' 1>&2

echo '' 1>&2



echo '' 1>&2

echo 'ERROR: named is not running' 1>&2

echo '' 1>&2




if [ "$pids" != '' ] ; then

/bin/kill $pids




echo '' 1>&2

echo 'usage: /etc/init.d/named.sh {start|reconfigure|stop}' 1>&2

echo '' 1>&2



4.2 Start Bind

./ start

4.3 Start Failed what should I do?

If this does not work run first look at permissions. Try to su the user you created and make sure that user can see and access everything. I had my named directory 700 root:wheel which prevented me from starting at first. I quick fix is to chmod –R named:named /usr/local/named then change back to root files you think don’t need to have that permission. If that fails run this to see if your missing files or where its breaking:

truss more

Previous posts