0

Possible Duplicate:
bind9 in a chroot jail - necessary or not?

I'm redoing my external dns servers and thinking about skipping chroot this time. And using apparmor or selinux as an alternativen. Any thoughts?

I'm using team cymrus bind template as ..template :) But when more ppl are administrating the servers, default packages are prefered imho.

0

1 Answer 1

3

I'm absolutely not a security expert, so anything I say is IMHO.

Running BIND as root without apparmor/chroot/selinux is not a sin. (BIND9 never had known vulnerabilities allowing code execution.)

Running it unprivileged is better.

Running under apparmor is even better.

Running both - under apparmor and unprivileged is even better.

(Besides, apparmor vs chroot - apparmor is probably preferred.)

Not the answer you're looking for? Browse other questions tagged .