DNS amp; Mail in the DMZ.ppt

DNS Mail in the DMZ Jason Heiss Collective Technologies jheiss@ jheiss@ Firewall Architectures Screening Router Architecture Screened Subnet Architecture DNS(Domain Name Service) Goals Separate internal and external DNS servers Limit the information about your network that is publicly available Protect the internal DNS server from attack Run as separate user Successful attack on DNS server does not give root Run in chroot environment Successful attack doesn’t expose entire server Internal BIND Configuration named.conf options { forward only; forwarders { ; ;}; } zone “” { type master; file “”; } No root hints file Zone files contain full info DMZ BIND Configuration named.conf acl slaves { ; ; }; options { version “”; directory “/”; # Really /var/named named-xfer “/bin/named.xfer”; allow-transfer { slaves; }; } zone “.” { type hint; file “root.hints”; }; zone “” {type master; file “”; }; Zone files contain only external hosts Running BIND as Non-root User Very simple starting with BIND 8 “named –u bind –g bind” The only things the bind user should be able to write to are files for slave zones By default, these are dumped into the main directory (from named.conf) with somewhat random names This directory, therefore, would need to be writeable by bind Best to specify specific filenames for each slave zone in named.conf and make only those files writeable by bind Running BIND in chroot Looks simple “named –t /var/named” syslog Can’t get at /var/run/log (or /dev/log or whatever) “syslog –l /var/named/var/run/log” holelogd from Obtuse System’s utils package ndc named makes a UNIX socket for ndc to talk to mkdir /var/named/var/run ln –s /var/named/var/run/ndc /var/run/ndc Running BIND in chroot, cont. Slaves Zone transfers to slaves use named-xfer Must reside in chroot directory Probably will require some dynamic libraries (or compile a static version of named-xfer) /usr/libexec/ld-elf.so.1 /usr/lib/libutil.so.3 /usr/lib/libc.so.4 ndc ndc, for