|
Now is the Time for BIND Version 9.1.0
A flurry of warnings from several security watchdog agencies and individuals
declared "Serious Internet Security Holes" and warn the internet community
with dire headlines and an opening paragraph warning to Brace Up... The Games
are about to begin. See Computer World Article:
ref: http://computerworld.com/cwi/story/0,1199,NAV65-663_STO57079,00.html.
While I'm not personally affiliated with any of the groups mentioned in the
article I hold a responsible position within the community and owe my income
to people who trust me to watch and warn them of potential security exposures.
This one caught my attention. Not because its new but because the time seems
right with the release of BIND (The Next Generation) 9.1.0.
I installed 9.1.0 early this morning after reading the hype and the 9.1.0
release notes. I'm impressed. The hardest part of the upgrade and conversion
was fetching the tarball. We've all faced busy sites. This morning was
typical new release, new kernel, first day of the newest kewlest toy.
After four or five busy-retry-redial attempts I was able to fetch the 3MB
tarball from ftp.isc.org. Installation was simple and straightforward
without any unpleasant surprises. OK, two easily worked around gotchas.
Of course the MD5 checksum has changed. As Bind 9.1.0 isn't available from
an official FreeBSD source via cvsup no FreeBSD MD5 signature is available.
Easy enough to work around from the command-line or by generating a new MD5
signature using the tarball and MD5 bind-9-1-0.tar.gz. Of course this proves
nothing therefore I suggest you work around the MD5 checksum test at the CLI.
The bind Makefile changed and the Bind 9.0.0 patch-makefile.in required a
one line change where BSD bind stores named.conf in /etc/namedb. I simply
deleted the patch and moved on with the install.
An authors note recommends the use of your systems openssl in place of
Binds Security apparatus in order to decrease working set size, overhead,
and improve throughput using DNSSEC. We want to use DNSSEC where possible
to insure the integrity of our DNS session partner and the exchanged
authoritative namespace data.
There are several pre-Bind 9 options which are no longer supported and
depricated. Bind issues a diagnostic and continues to initialize. You
can take your time and make the changes at your leisure without losing
time or wasting energy nor fighting off unnecessary aggrevation.
I built bind after installing the tarball and interrupting the configuration
as follows.
1). bind9 configure at the prompt: configure --prefix=/usr --with-openssl=/lib
2). make
3). make test
4). ndc stop
5). pkg_remove bind-your-release
6). make install
7). move named.conf from /etc/namedb to /etc
8). named -u bind
Thats all there is to it. If you followed the instructions and your intuition
bind is now up and running and happily serving to resolve foreign requests.
I've been monitoring my bind 9.1.0 for over 14 hours now. So far so good. All
is working as described. Tomorrow I'll generate new DNSSEC keys and configure
rndc which replaces ndc.
In closing I neglected to mention that ndc has is no longer included and
has been replaced by a secure implementation of ndc called rndc. You can
read about rndc and its new approache to security and control in the
release notes and perhaps in a follow-up article.
Also of interest is nslookup. We were warned and knew it was simply a matter
of time. Now its official... sort of. Nslookup now issues a diagnostic message
on startup indicating its demise is eminant... get used to using dig and host.
I'm sorry to see a faithful old dog retired... but like me sooner or later,
everything faces renewal and we all find ourselves replaced. :)
Later Gators,
EGaDS @ efnet #freebsdhelp
aka
Steven Guitar Wicked
post script from the channel:
The bind announcement...
"No severity one exposures were added to the list today. The exposures were
comprised zones enabling some wannabe asswipe to exercise an integrity
exposure which resulted in a DoS. Bind Version 9.1.0 is a rewrite a quite
nice. Its been running w/o a problem since early this morning.
Bind version 9.1.0 enables the use of the base openssl library in place of
binds builtin capability which they claim reduces overhead and improves
throughput.
|
