Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

176

|

Chapter 6: Securing Domain Name Services (DNS)

If you intend to use Transaction Signatures or DNSSEC (both are explained later in

this chapter), you’ll need to send configure the option

--with-openssl=yes.

After the configure script finishes, type

make. After that finishes successfully, type make

install

. All BIND binaries and support files will be installed where you specified.

Preparing to Run BIND (or, Furnishing the Cell)

BIND itself is installed, but we’re not ready to fire up named quite yet. I’ve alluded to

BIND’s checkered past when it comes to security: common sense tells us that any

program with a history of security problems is likely to be attacked. Therefore, isolat-

ing BIND from the rest of the system on which it runs is a good idea. One way to do

this, which is explicitly supported in BIND Versions 8 and 9, is by changing named’s

root directory.

If BIND thinks that root is some directory other than /, a prospective cracker would

be trapped, for example, should he exploit some obscure buffer-overflow vulnerabil-

ity that allows him to become named.Ifnamed is run with its root changed to /var/

named, then a file that appears to named to reside in /etc will in fact reside in /var/

named/etc. Someone who hijacks named won’t see configuration files for the entire

system; ...