Bind-Chroot-Howto (Debian)
|
Bind-Chroot-Howto
(Debian) Version 1.3 This document describes
how to install the DNS server Bind on Debian so that it runs out of a chroot
jail for security reasons. This howto is meant as a practical guide; it does not cover the theoretical backgrounds. They are treated in a lot of other documents in the web. This document comes without warranty of any kind! Install Bind And Chroot It apt-get install bind9 For security reasons we want to run BIND chrooted so we have to do the following steps: /etc/init.d/bind9 stop On Debian Sarge (3.1): Edit the file /etc/default/bind9 so that the daemon will run as the unprivileged user 'bind', chrooted to /var/lib/named. Modify the line: OPTS="-u bind" so that it reads OPTS="-u bind -t /var/lib/named":
On Debian Woody (3.0): Edit the startup script /etc/init.d/bind9 so that the daemon will run as the unprivileged user 'nobody', chrooted to /var/lib/named. Modify the line: OPTS="" so that it reads OPTS="-u nobody -t /var/lib/named":
Create the necessary directories under /var/lib: mkdir -p /var/lib/named/etc Then move the config directory from /etc to /var/lib/named/etc: mv /etc/bind /var/lib/named/etc Create a symlink
to the new config directory from the old location (to avoid problems when bind
is upgraded in the future): ln -s /var/lib/named/etc/bind /etc/bind Make null and random
devices, and fix permissions of the directories: mknod /var/lib/named/dev/null
c 1 3 On Debian Sarge (3.1): chown -R bind:bind /var/lib/named/var/* On Debian Woody (3.0):
chown -R nobody:nogroup /var/lib/named/var/*
We need to modify the startup script /etc/init.d/sysklogd of sysklogd so that we can still get important messages logged to the system logs. Modify the line: SYSLOGD="" so that it reads: SYSLOGD="-a /var/lib/named/dev/log":
Restart the logging
daemon: /etc/init.d/sysklogd restart Start up BIND,
and check /var/log/syslog
for any errors: /etc/init.d/bind9 start Good luck!
|
Join the discussion.
www.seamlessenterprise.com
IP Convergence
Integrate your wireless and wireline networks.
Learn how from the experts at Sprint.
www.seamlessenterprise.com
Wireless & Wireline Integration
Thoughts, strategies and solutions: join the discussion
www.seamlessenterprise.com
Unified Communications 2009
Join the Discussion. Now.
www.seamlessenterprise.com







Recent comments
10 hours 59 min ago
12 hours 27 min ago
16 hours 2 min ago
18 hours 55 min ago
21 hours 53 min ago
22 hours 34 min ago
22 hours 49 min ago
23 hours 48 min ago
1 day 53 min ago
1 day 1 hour ago