Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
bind9 in a chroot jail - necessary or not?

I'm redoing my external dns servers and thinking about skipping chroot this time. And using apparmor or selinux as an alternativen. Any thoughts?

I'm using team cymrus bind template as ..template :) But when more ppl are administrating the servers, default packages are prefered imho.

share|improve this question

marked as duplicate by Shane Madden, Lucas Kauffman, John Gardeniers, Hyppy, mgorven Aug 3 '12 at 5:27

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

I'm absolutely not a security expert, so anything I say is IMHO.

Running BIND as root without apparmor/chroot/selinux is not a sin. (BIND9 never had known vulnerabilities allowing code execution.)

Running it unprivileged is better.

Running under apparmor is even better.

Running both - under apparmor and unprivileged is even better.

(Besides, apparmor vs chroot - apparmor is probably preferred.)

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.