This site was created after helping numerous people over the years with similar issues. Starting with locking down the os of systems ,webserver issues like Apache or Sun One , application server issues such as WebSphere and Coldfusion to application security related issues. Penetration testing, stress testing, finding application bugs.. I hope it all to be here and more!
This document describes installing the BIND 9 nameserver to run in a
chroot jail and as a non-root user, to provide added security and minimise the potential effects of a security compromise. This is for Bind 9 only and freebsd.
Credits:
This is the Chroot-BIND HOWTO for freebsd. It is assumed that you already know how to configure and use BIND (the Berkeley
Internet Name Domain). If not, please go read the DNS HOWTO and get a good understanding on DNS.
The latest version of this can be found at http://www.setuid.us/HowTo/Chroot-Bind-Howto.html
The following worked on my system which is FreeBSD 4.4-stable one with intel chipset and one with cyrix chipset. It also worked on
FreeBSD 4.5-stable with smp. I hope you have as much luck as I do.
The contents of this document worked for myself on the systems mentioned above. I have seen a number of different setups that
work equals as well. This is just how I decided on doing it. I have only installed bind on BSD/Solaris but with slight modifications it
should be portable across the different flavors of UNIX… sometimes those slight modifications are the ones that you can’t figure out
why its not working! If you have any comments/updates please send I will update this document in a timely manner.
Create the user you want bind to run as. I used named. This should create a named group as well.
I like to keep everything under /usr/local/ so mine is as follows:
/usr/local/
+-- named
+--dev
+-- etc
| +--namedb
| +--slave
+--var
+--run
Note:other directories will be created with the configure /make
Since we have not installed bind into our new directory structure lets do it now.
If you already had bind installed and setup the copy the Data files from your current install to the new install path.
If you did not have bind already installed make install just put some new files into /etc.
We need to move those files from /etc and move them into our new bind home directory.
Then give the bind user we created permissions to this directory and the files in it.
I would change permissions on some of the files in our new etc directory.
chflags schg and modify them just to have named user, root and wheel.
This is up to you if you want to do this or not (it could break some things).
chflags schg /usr/local/named/etc/*(*)
Next we need to change how syslog is going to log in the chroot env.
We need to edit a few lines in out named.conf file. I keep mine in /usr/local/named/etc/namedb some people like to keep it in
/usr/local/named/etc its up to you.
I like to put this script into /usr/local/etc/rc.d/
That was it will stop and start on boot. You can do it from rc.conf or whever you like to start your daemons.
chroot /usr/local/named/ sbin/named -u named –c /etc/namedb/named.conf
If this does not work run first look at permissions. Try to su the user you created and make sure that user can see and access everything. I had my named directory 700 root:wheel which prevented me from starting at first. I quick fix is to chmod –R named:named /usr/local/named then change back to root files you think don’t need to have that permission. If that fails run this to see if your missing files or where its breaking:
truss chroot /usr/local/named/ sbin/named -u named –c /etc/namedb/named.conf | more
This document describes installing the BIND 9 nameserver to run in a
Michael Johnson
V1.0 DEC 28, 2002
Credits:
This is the Chroot-BIND HOWTO for solaris. It is assumed that you already know how to configure and use BIND (the Berkeley
Internet Name Domain). If not, please go read the DNS HOWTO and get a good understanding on DNS.
The latest version of this can be found here!
The following worked on my system which is Solaris 8 one with processor.
I hope you have as much luck as I do.
The contents of this document worked for myself on the systems mentioned above. I have seen a number of different setups that
work equals as well. This is just how I decided on doing it. I have only installed bind on BSD/Solaris but with slight modifications it
should be portable across the different flavors of UNIX… sometimes those slight modifications are the ones that you can’t figure out
why its not working! If you have any comments/updates please send I will update this document in a timely manner.
Create the user you want bind to run as. I used named. This should create a named group as well.
I like to keep everything under /usr/local/ so mine is as follows:
/usr/local/
+-- named
+--dev
+-- etc
| +--namedb
| +--slave
+--var
+--run
Note:other directories will be created with the configure /make
Since we have not installed bind into our new directory structure lets do it now.
If you already had bind installed and setup the copy the Data files from your current install to the new install path.
If you did not have bind already installed make install just put some new files into /etc.
We need to move those files from /etc and move them into our new bind home directory.
Then give the bind user we created permissions to this directory and the files in it.
cd /usr/local/named
chown -R root.named opt var
chmod -R g-w var
chmod -R -w opt usr
chmod -R o-rx .
chmod g+w var/run var/log
touch var/log/all.log var/run/named.pid
chown named.named var/log/all.log var/run/named.pid
find . -type f -exec chmod ug-s {} \;
MAKE SURE THIS RETURNS NOTHING!
2.6 Syslog Modification
Next we need to change how syslog is going to log in the chroot env.
I like to put this script into /etc/init.d/ then symlink it to rc2.d
That was it will stop and start on boot. You can do it from wherever you like to start your daemons.
./
If this does not work run first look at permissions. Try to su the user you created and make sure that user can see and access everything. I had my named directory 700 root:wheel which prevented me from starting at first. I quick fix is to chmod –R named:named /usr/local/named then change back to root files you think don’t need to have that permission. If that fails run this to see if your missing files or where its breaking:
truss
