Re: Task harden.

["John H. Robinson, IV" <jhriv@ucsd.edu>]

On Mon, Apr 02, 2001 at 11:42:11AM -0400, xsdg wrote:
> > if this task-harden does ANYTHING at all it must get bind running in a
> > chroot jail as named.named and not root.  
> How can bind bind (no pun intended) to port 53 if it isn't root?

you use tcpserver to listen to port 53, with then spawns tinydns or
dnscache (as required).

tinydns and dnscache both run in a chroot jail, as a non-root user.
tcpserver.c is merely 426 lines long. all the files in the
ucspi-tcp-0.88 tarball are 9151, making it possible to do a fairly
complete audit for potential problems.

if you are using BIND, then you deserve what you get.[1]

-john

[1] call me hearless and cruel, but i put sendmail, bind, and wu-ftpd
    all in the ``please r00t me!'' category