* Onno Ebbinge said: > >> running named non-root and let YOU choose if you want > >> to run named root or non-root! With a little effort > >> you can get more security. > >Did you *really* read what's said in the README.Debian? I'll just quote the > >relevant part: > > Yes, but did -you- *really* read my compromis? It was not a compromise. Read on. > >"Note that if you run named as a user other than root, it will not be able to > >find new interfaces that appear dynamically, such as during a PCMCIA card > >insertion, or if you're running some flavors of IPSEC and/or IP over IP > >tunnels." > > Then write a post install script that states this! > THEN ask the user the next question: > > Do you want to run named as a user other than root? (Y/N): [N] > > Note the default! But when I want to run named as a user other > than root because I'm a little nervous about security then > I should have that possibility! (and say Y!) Instead of patching > /etc/init.d/bind. You still seem to miss the point. The problem is not with bind starting as another user but with running it on a machine with dynamically changing IP interfaces. bind watches for interfaces going up and down and attaches itself to listen on any of these interfaces that may appear. Now, since the DNS port is 53 TCP/UDP bind has to be root to do it successfuly. After being started as root, AFAIR, bind drops the root privileges completely. If you have a notebook or (as said in the README) using some tunneling stuff, you might have interfaces going up and down dynamically all the time. If bind isn't run as root then you'd have to restart it BY HAND every time any interface changes. As to your security objection and the huge effort that modifying the bind startup file - you do it just ONCE and then forget it. OTOH, the solution with asking a question during the install time would be quite OK. Still, if you answer N to the question above, you'd still have to modify the startup script by hand should you change your mind :)) regards, marek
Attachment:
pgpr_uQa4soBk.pgp
Description: PGP signature