Re: solution: running DNS as non-root

[Aaron Jackson <jackson@negril.msrce.howard.edu>]

I just noticed this from the NetBSD kernel options man page:

options IPNOPRIVPORTS
     Normally, only root can bind a socket descriptor to a so-called
     ``privileged'' TCP port, that is, a port number in the range 0-1023.
     This option eliminates those checks from the kernel. This can be useful
     if there is a desire to allow daemons without privileges to bind those
     ports, e.g. on firewalls. The security tradeoffs in doing this are sub-
     tle.  This option should only be used by experts.

Aaron Jackson		jackson@msrce.howard.edu