DNS HOWTO : Basic security options. : Running named as non-root
Previous: Protecting against spoofing
Next: A real domain example

6.3. Running named as non-root

It is a good idea to run named as a user other than root, so that if it is compromised the privileges gained by the cracker are as limited as possible. You first have to create a user for named to run under, and then modify whatever init script you use that starts named. Pass the new user name and group to named using the -u and -g flags.

For example, in Debian GNU/Linux 2.2 you might modify your /etc/init.d/bind script to have the following line (where user named have been created):


start-stop-daemon --start --quiet --exec /usr/sbin/named -- -u named 

The same can be done with Red Hat and the other distributions.

Dave Lugo has described a secure dual chroot setup http://www.etherboy.com/dns/chrootdns.html which you may find interesting to read, it makes the host your run your named on even more secure.


DNS HOWTO : Basic security options. : Running named as non-root
Previous: Protecting against spoofing
Next: A real domain example