Re: bind running as root in Mandrake 7.0

[philarete () MINDSPRING COM (Brock Sides)]

Nicolas MONNET wrote:

> bind is run as user / group 'root' in Mandrake 7.0, and probably in
> Redhat6.x as well. This is a surprising (if not stupid) setting given the
> fact that sploits exist that easily break out of any chroot jail in such a
> case; and that switching users is as easy as adding an option to
> named. Esp. given the infuriatingly poor security track record of named
> ...
>
> Indeed, here's a simple patch against /etc/rc.d/init.d/named that I
> strongly suggest applying. It does'nt seem to cause any problem for me.

RedHat 6.2 runs BIND as user/group "named", IIRC.

Your patch will break things if you're running a slave nameserver,
unless you also chown /var/named (or wherever you're keeping your
automatically generated zone files) to the user you're running named as.

Brock Sides
philarete () mindspring com