summaryrefslogtreecommitdiff
path: root/usr.sbin/bind
diff options
context:
space:
mode:
Diffstat (limited to 'usr.sbin/bind')
-rw-r--r--usr.sbin/bind/README.OpenBSD3
-rw-r--r--usr.sbin/bind/bin/named/named.813
2 files changed, 14 insertions, 2 deletions
diff --git a/usr.sbin/bind/README.OpenBSD b/usr.sbin/bind/README.OpenBSD
index ec4822d764f..d30a6c738fd 100644
--- a/usr.sbin/bind/README.OpenBSD
+++ b/usr.sbin/bind/README.OpenBSD
@@ -1,10 +1,11 @@
-$OpenBSD: README.OpenBSD,v 1.6 2003/11/18 19:04:30 jakob Exp $
+$OpenBSD: README.OpenBSD,v 1.7 2004/03/24 07:59:07 deraadt Exp $
additional features
- call tzset before chroot
- open /dev/null before chroot
- write pid-file before chroot
+- privilege separation for binding to privileged ports from within chroot
- arc4random() support (integrated in 9.3.0-snapshot)
- fall back to system default random device when running chroot
- add LCG (Linear Congruential Generator) implementation to libisc
diff --git a/usr.sbin/bind/bin/named/named.8 b/usr.sbin/bind/bin/named/named.8
index 753a66f3d24..848144cde44 100644
--- a/usr.sbin/bind/bin/named/named.8
+++ b/usr.sbin/bind/bin/named/named.8
@@ -27,10 +27,13 @@ part of the BIND 9 distribution from ISC. For more
information on the DNS, see RFCs 1033, 1034, and 1035.
.PP
When invoked without arguments, \fBnamed\fR will
+fork into two processes for privilege separation.
\fBchroot()\fR to \fI/var/named\fR,
read the default configuration file
\fI/var/named/etc/named.conf\fR, read any initial
-data, and listen for queries.
+data, and listen for queries. The privileged process
+will communicate with the child and bind to privileged
+ports on its behalf. See CAVEATS section below.
.SH "OPTIONS"
.TP
\fB-c \fIconfig-file\fB\fR
@@ -154,3 +157,11 @@ The default process-id file.
.SH "AUTHOR"
.PP
Internet Software Consortium
+.SH "CAVEATS"
+\fBnamed\fR runs privilege separated for binding
+the privileged ports after an interface or address
+change. The privileged process will only allow
+\fBnamed\fR to bind to default ports. Make sure
+you use unprivileged (>1024) ports if you change
+any of the default ports in \fBnamed's\fR
+configuration or on the command-line.