BIND

📜 历史文件已不具备现实意义

freebsd-update 目前已进入维护状态并可能在后续 FreeBSD 版本中逐步被替换掉。

今天搞了一个 大新闻。如果你用BIND并且今天之前没打过补丁的话，请读到这里为止，立即去补吧。

我觉得还是得提高知识水平。做 freebsd-update 补丁的时候，赫然发现修改的文件中有一个不认识的：

这次休假前头一天晚上收到了 ISC 发来的安全公告 CVE-2011-1910。我起草完 FreeBSD 安全公告 FreeBSD-SA-11:02.bind.asc 之后就去休假了，这里补上这个漏洞的说明。

无论你是否使用 DNSsec，只要用 BIND 9.x 来做 DNS 缓存解析服务（而不仅仅做Authoritive DNS服务），就有可能受到这个漏洞的影响。而攻击的方法也相当简单，攻击者只要建立一个 DNS 域，令在回应域名不存在的同时发回一个大的 RRSIG RRset，即可触发 BIND 的某处断言令其退出。

DNS是目前互联网上使用最为普遍，同时也是漏洞很多的一个协议。DNS投毒攻击（Poisoning）是一种比较常见的攻击手法，具体而言，通常一台 DNS 缓存服务器能够影响大量的客户机，通过投毒攻击，能够使得大量用户访问某个具体域名时得到不正确的结果（例如，钓鱼网站，等等）。

目前我知道国内有至少两家主要的互联网公司用了这样的域名，不知道他们用的是什么域名服务器，至少 BIND 9 是不支持这样做的。

RFC 952 - 美国国防部互联网主机表规范中的相关条文如下：

This article has suggested a way of hiding version.bind string. From a security perceive, this is an overkill and can usually be harmful:

• While it’s true that you can hide version.bind, the fact that version.bind is can be queried reveals that you are running BIND. It makes little sense to fake a version.
• The need of hiding information, which is unnecessarily hidden like this, means that the system administrator is neglecting security.
• Therefore, FOREACH(version.bind is queriable and is hidden) HACKEM :-)

Security can NOT be built on what others are not aware of.

As title. We *need* to struggle to make the upcoming 6.0-RELEASE a good release . I hope we can show the great improvements taken place in 6-CURRENT and hopefully we can cut 6-STABLE this June.

Highlights on recent 6-CURRENT that was not merged (and may never be merged):

• MPSAFE VFS
• Integrated VFS hashing (generallized, traditionally it’s different on ufs, msdosfs, etc)
• 64bit-ize of several utilities, to ensure better usage of large storage.

Today FreeBSD will have its 5.3-RC1 if there is no other problem occours. I have sent a private mail to Doug Barton about a strange issue I have in BIND9, however, it does seem to be serious enough nor it is clear to determine the impact. I may post it later on a public list.

5.3-RC1 is also the point that I can suggest you to install 5-STABLE instead of 4-STABLE because most of the show-stopping issues are addressed and being corrected.

I finally got beastie.frontfree.net running bind 9.3 (as FreeBSD 5.3-BETA7 does, which is chroot’ed by default). While this is accomplished primarily with help of src/UPDATING’s instructions and Doug Barton’s excellent mergemaster(8). BIND stands for “Berkeley Internet Name Daemon” and is the de-facto standard of DNS implementation.

As always, it’s available at ftp.freebsdchina.org/china_ports/delphijfork.

I have adopted all RELENG_5 features here, bind9, etc. Also the delphijfork features are retained.