Re: Paranoid question regarding Bind

[Gunnar Wolf <gwolf@campus.iztacala.unam.mx>]

> make sure that both your bind daemons run in a different chroot'ed
> environment. That helps security a lot. If a bad cracker compromises
> your daemon he won't have much to show for ;)

That would not help much - The particular vulnerability that Nessus told
me about was DNS poisoning - The attacker never compromises your system;
however, he can make Bind resolve to incorrect addresses when a client
asks it for something. This can lead to minor jokes, to your clients
blaming you for having a bad network setup, or to the attacker
redirecting, say, a popular site to his machine, stealing confidential
user information.

Greetings,

------------------------------------------------------------
Gunnar Wolf - gwolf@campus.iztacala.unam.mx - (+52)5623-1118
Desarrollo y Admon. de Sistemas en Red - FES Iztacala - UNAM
Departamento de Seguridad en Computo   -   DGSCA    -   UNAM
------------------------------------------------------------
Quidquid latine dictum sit, altum viditur.