Re: Location of BIND
From: Christopher Nehren (apeiron_at_comcast.net)
Date: 11/30/04
- Next message: David Lord: "Re: Caching DNS and A names..."
- Previous message: Wil Schultz: "Re: Caching DNS and A names..."
- In reply to: Logan Shaw: "Re: Location of BIND"
- Next in thread: Wil Schultz: "Re: Caching DNS and A names..."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: 30 Nov 2004 03:39:16 GMT
On 2004-11-30, Logan Shaw scribbled these
curious markings:
> So anyway, can you explain your approach a little more and the
> benefits of it? I have to admit my named has been running happily
> for QUITE some time without an update. (In fact, I should probably
> check its version number, but I digress...)
First, I start by installing the port with a PREFIX option that differs
from the default, like this:
cd ${PORTSDIR}/dns/bind9
make PREFIX=/var/named install
Note that if you also define PORT_REPLACES_BASE_BIND9, then the prefix
is set to /usr (which ... oddly enough, and I realise this while reading
the Makefile ... *un*chroot's BIND9 on recent 5.x versions of FreeBSD,
as well as -CURRENT. I shall have to send-pr or send email about that.),
so it's probably best to avoid that option for this configuration.
Okay, barring any errors, you have a BIND9 installed in /var/named. I
create a /dev/random in the chroot as prompted by the pkg-message, and
then set up rndc and randomness as that is a 4.x box in question. Then I
do the rest of the nameserver configuration.
Here are the /etc/rc.conf options to enable this setup on a 4.x machine:
named_enable="YES"
named_program="/var/named/sbin/named"
named_flags="-t /var/named -u bind -c /etc/named.conf"
That's pretty much all for my approach. As for the benefits: they're the
same as any chroot setup: compartmentalisation, and
compartmentalisation's inherent security. I suppose that I *could* do a
jail, but when I set up that system's BIND I wanted to mimic my OpenBSD
setup as closely as possible -- and to be honest, I wasn't nearly as
familiar with jails or many other things as I am now.
I might be missing a detail or two; aside from portupgrade, it's been a
while since I too have changed my BIND configuration.
-- I abhor a system designed for the "user", if that word is a coded pejorative meaning "stupid and unsophisticated". -- Ken Thompson Linux: "How rebellious ... in a conformist sort of way." Unix is user friendly. However, it isn't idiot friendly.
- Next message: David Lord: "Re: Caching DNS and A names..."
- Previous message: Wil Schultz: "Re: Caching DNS and A names..."
- In reply to: Logan Shaw: "Re: Location of BIND"
- Next in thread: Wil Schultz: "Re: Caching DNS and A names..."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
|
