Re: Unusual permissions on /var/named/etc/namedb/master?

From: Lowell Gilbert (freebsd-questions-local_at_be-well.ilk.org)
Date: 11/08/05

  • Next message: Dave: "bruteforce not restarting pf?" 
    To: Josh Tolbert <hemi@puresimplicity.net>
Date: 08 Nov 2005 12:03:23 -0500

    Josh Tolbert <hemi@puresimplicity.net> writes:

    > Hello,
    >
    > I'm running DHCP + dynamic DNS here on my home LAN and I've noticed a problem
    > that needs a manual fix every time the DNS machine gets rebooted. It doesn't
    > happen very often, but it does happen. :)
    >
    > My firewall/gateway machine runs FreeBSD-5.4-RELEASE of some patchlevel. It
    > uses ISC DHCPD from ports to update my DNS server, another FreeBSD machine
    > (now running 6.0-RELEASE) with new entries when machines register with the
    > DHCP server. The problem arises because by default named runs -u bind, however
    > /var/named/etc/namedb/master is owned by root. I believe this is caused by
    > /etc/mtree/BIND.chroot.dist, since I'm running bind chrooted (the default
    > setup). When the DNS machine reboots, I have to manually chown
    > /var/named/etc/namedb/master (or /etc/namedb/master) to bind before updates
    > will continue, otherwise I see errors such as
    >
    > named[297]: dumping master file: master/tmp-QQ2UU6pWaZ: open: permission denied
    >
    > Is there any good workaround for this issue? I'd like to keep bind running as
    > the bind user as well as keep bind chrooted if possible. I know I could edit
    > the mtree file on my machine, but that seems somewhat kludgy to me.
    >
    > Thanks for any help/advice you can give me,

    Normally mtree is only automatically run by installworld.
    Is that what causes the permissions to be reverted?
    If so, then change the mtree file (and keep the modifications over
    time when you run mergemaster).
    If not, then figure out what *is* changing the permissions.
    _______________________________________________
    freebsd-questions@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"

  • Next message: Dave: "bruteforce not restarting pf?"

    Relevant Pages

    • Unusual permissions on /var/named/etc/namedb/master?
      ... I'm running DHCP + dynamic DNS here on my home LAN and I've noticed a problem ... that needs a manual fix every time the DNS machine gets rebooted. ... The problem arises because by default named runs -u bind, ...
      (freebsd-questions)
    • [NEWS] BIND 9 DNS Cache Poisoning
      ... BIND 9 DNS Cache Poisoning ... source UDP port and DNS transaction ID can be effectively predicted. ... address of the target name server), and the destination UDP port (53 the ...
      (Securiteam)
    • [UNIX] Multiple Remote Vulnerabilities in BIND4 and BIND8
      ... ISS X-Force has discovered several serious vulnerabilities in the Berkeley ... Internet Name Domain Server (BIND). ... majority of DNS servers on the Internet. ... deployed recursive DNS servers on the Internet. ...
      (Securiteam)
    • Re: DNS Manipulation via IPTables or other means?
      ... You might use the BIND view functionality ... I thought I could alter DNS responses ... EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE ... The NSA has designated Norwich University a center of Academic ...
      (Security-Basics)
    • Re: DNS Manipulation via IPTables or other means?
      ... Not sure about iptables. ... I nwhat way is BIND not scalable -- ... I thought I could alter DNS responses ... EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE ...
      (Security-Basics)
    Loading