[Fwd: cvs commit: ports/dns/bind9 Makefile distinfo
ports/dns/bind94 Makefile distinfo ports/dns/bind95 Makefile
distinfo]
Jeremy Chadwick
koitsu at FreeBSD.org
Fri Jul 11 15:29:03 UTC 2008
On Fri, Jul 11, 2008 at 08:54:48AM -0600, Brett Glass wrote:
> Is there a way to restrict the ports which BIND selects -- perhaps
> at the expense of a small amount of entropy -- such that it doesn't
> try to use UDP ports which are administratively blocked (e.g. ports
> used by worms, or insecure Microsoft network utilities)? We don't
> dare turn these port blocks off, or naive users will fall prey to
> security holes in Microsoft products. But if BIND doesn't know to
> work around them, lookups will occasionally (and infuriatingly!)
> fail.
query-source has an argument called "port" which will do what you want.
That option *only* affects UDP queries, however; TCP queries are always
random.
--
| Jeremy Chadwick jdc at parodius.com |
| Parodius Networking http://www.parodius.com/ |
| UNIX Systems Administrator Mountain View, CA, USA |
| Making life hard for others since 1977. PGP: 4BD6C0CB |
More information about the freebsd-security
mailing list