Solaris DNS : chroot the BIND DNS server

The idea behind running BIND in a chroot jail is to limit the amount of access any malicious individual could gain by exploiting vulnerabilities in BIND. It is for the same reason that we run BIND as a non-root user. This should be considered as a supplement to the normal security precautions (running the latest version, using access control, etc.), certainly not as a replacement for them.

The process described below prevents access to the “/” (root) directory if BIND is hacked. It is possible with BIND version 8 or above, and is supported on Solaris 8 or above.

1. Create the user who will be running BIND. Don’t run BIND as root.

useradd -g nobody -s /usr/bin/false dnsguy

2. Create chroot directory and set permissions:

mkdir -p /chroot/etc /chroot/var /chroot/var/run

chown dnsguy /chroot/var/run

chgrp nobody /chroot/var/run

3. Move zone and named.conf files over:

mv /etc/named.conf /chroot/etc

mv /var/named /chroot/var/named

4. Copy some more /etc/ files over:

cp /etc/TIMEZONE /etc/profile /chroot/etc

5. Start in.named:

/usr/sbin/in.named -u dnsguy -t /chroot