Why BIND / NAMED service in Chroot?

You know, Why bind in Chroot?

  
  • The idea behind chroot is fairly simple. When you run BIND (or any other process) in a chroot jail, the process is simply unable to see any part of the filesystem outside the jail. For example, in this document, we'll set BIND up to run chrooted to the directory /chroot/named. Well, to BIND, the contents of this directory will appear to be /, the root directory. Nothing outside this directory will be accessible to it. You've probably encounted a chroot jail before, if you've ever ftped into a public system.
  • The idea behind running BIND in a chroot jail is to limit the amount of access any malicious individual could gain by exploiting vulnerabilities in BIND. It is for the same reason that we run BIND as a non-root user. 
Note:
The domain name service provided by BIND (named) software. It uses both UDP and TCP protocol and listen on port 53. DNS queries less than 512 bytes are transferred using UDP protocol and large queries are handled by TCP protocol such as zone transfer.                                                                  

    Comments

    Post a Comment

    Popular posts from this blog

    Resolved: DOCKER: Error response from daemon: Could not attach to network / rpc error: code = 7 desc = network not manually attachable.

    Image
    I got this error: 'docker: Error response from daemon: Could not attach to network <nw-name>: rpc error: code = 7 desc = network <nw-name> not manually attachable.' when i try to create the container on the overlay network on swarm mode enabled, In docker 1.12 with swarm mode enabled, "Swarm" scoped networks (see the "SCOPE" column) cannot be used for docker run, only for services and now it has been rectified. I'm using updated version of docker, but still why i'm experiencing the error ? because the network just created but not manually attachable. To fix the issue we gonna use --attachable flag while creating network. [ --attachable             Enable manual container attachment ] (Need to create service on the overlay network, so that the overlay network will available / list on the worker node) docker inspect attnw (attnw is our test network)should show your own c
    Read more

    yum failed 6 times. Cannot continue!

    Error while cPanel installation: (ERROR): - ssystem [EXIT_CODE] '/usr/bin/yum' exited with 1 (ignored) (DEBUG): - ssystem [END] (FATAL): yum failed 6 times. Cannot continue! fix: It looks like you have some name resolution issues on the server. Just run the following commands on your server and it will resolve the name resolution issues. #echo "nameserver 8.8.8.8" >> /etc/resolv.conf #echo "nameserver 8.8.4.4" >> /etc/resolv.conf if it is not working properly still facing same error, then here we go, # rpm -e --nodeps bind-chroot # rpm -e --nodeps bind # yum install bind
    Read more

    unexpectedly shrunk window (repaired) in dmesg log - TCP Peer

    Don't Panic, This normally occurs when a client decides to reduce its TCP window size, without the server expecting it. This can be the case when fragmentation is an issue, or when the client is using an embedded device with very little NIC buffer memory. This is a completely normal behaviour, and you’re likely to see quite a few such packets in your log. The messages are informational only, and are used to debug networking issues. I’d be worried if you saw hundreds of thousands of these packets, since there are attacks that involve packet fragmentation and small window sizes, but otherwise it’s just the normal sort of noise you should expect to see on any internet-facing network. In fact, the “repaired” part of your message is showing that your network driver fixed the issue, which is usually done by concatenating the payloads of two fragmented packets together. Shouldn’t be an issue at all. … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … … 
    Read more