Subject: Re: BIND DoS and remote compromise issues
To: Paul Hoffman <phoffman@proper.com>
From: Andrew Brown <atatat@atatdot.net>
List: tech-security
Date: 11/12/2002 14:27:01
>So, once we install BIND 9 from pkgsrc, what is the correct way to 
>change the system to use it?
>
>Do I simply change 'command="/usr/sbin/${name}"' in /etc/rc.d/named 
>to 'command="/usr/pkg/sbin/${name}"'?

short answer: yes.

long answer: no.

long answer justification?

try not to change the system supplied rc.d files, as doing so will
make upgrades less smooth.  for this case, if all you want to do is
change the command that gets run, you can put

	command="/usr/pkg/sbin/${name}"

into /etc/rc.conf.d/named and you're done.  in the short term.

if you, like me, are using any of the other "features" of named as
handled by the rc.d sub-system (eg, named_chrootdir), then you'll need
to do more work, since the command line interface to bind9 is not the
same as that of bind8.

for myself, i made a new named9_precmd in rc.conf.d/named, that did
the necessary work for prestart (i modelled it after the bind8 one we
already have), and put this small chunk of code at the top of said
file:

	if [ "$named" = "named9" ]; then
		start_precmd="named9_precmd"
		command="/usr/pkg/sbin/${name}"
		named=YES
	fi

so that i can set named to "YES", "NO", or "named9" (which means yes,
but runs bind9 instead).

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
werdna@squooshy.com       * "information is power -- share the wealth."