Re: BIND security question
On Thu, 30 Dec 1999, Pollywog wrote:
>
> On 30-Dec-1999 Onno wrote:
> > At 04:16 PM 12/28/99 -0000, Pollywog wrote:
> >>
> >>On 28-Dec-1999 root wrote:
> >>
> >>Was this someone trying to find out which BIND I am running?
> >>>
> >>> Unusual System Events
> >>> =-=-=-=-=-=-=-=-=-=-=
> >>> Dec 28 06:39:09 lilypad named[342]: unapproved query from
> >>> [206.79.22.9].1978
> >>> for "version.bind"
> >>> Dec 28 06:39:09 lilypad named[342]: unapproved query from
> >>> [206.79.22.9].1978
> >>> for "version.bind"
> >
> > I don't know the query but I't looks like bind is handeling it quite well
> > ;-)
> >
> > Anyway you have bind under another UID/GID than root, right?
>
> I installed the Debian package for BIND, and I just checked and it does appear
> to be running as root :(
>
> I will have to read the docs to determine if I can change that without
> compiling it myself.
Just append
-- -u named
on the end of the line start-stop-daemon line in the start section in
/etc/init.d/bind .
Of course, create the named user, because it does not exist in default.
Robert Varga
Reply to: