freebsd-dev/etc/mtree/BIND.chroot.dist

# $FreeBSD$
#
# Please see the file src/etc/mtree/README before making changes to this file.
#

/set type=dir uname=root gname=wheel mode=0755
.
    dev             mode=0555
    ..
    etc
        namedb
            dynamic uname=bind
            ..
            master
            ..
            slave   uname=bind
            ..
            working uname=bind
            ..
        ..
    ..
/set type=dir uname=bind gname=wheel mode=0755
    var             uname=root
        dump
        ..
        log
        ..
        run
            named
            ..
        ..
        stats
        ..
    ..
..
Add a file spec to create a chroot directory structure for a BIND name server. This file is not being used yet, but will be soon. 2004-09-27 08:15:34 +00:00			`# $FreeBSD$`
			`#`
			`# Please see the file src/etc/mtree/README before making changes to this file.`
			`#`

			`/set type=dir uname=root gname=wheel mode=0755`
			`.`
Create a named chroot directory structure in /var/named, and use it by default when named is enabled. Also, improve our default directory layout by creating /var/named/etc/namedb/{master\|slave} directories, and use the former for the generated localhost* files. Rather than using pax to copy device entries, mount devfs in the chroot directory. There may be some corner cases where things need to be adjusted, but overall this structure has been well tested on a production network, and should serve the needs of the vast majority of users. UPDATING has instructions on how to do the conversion for those with existing configurations. 2004-09-28 09:46:00 +00:00			`dev mode=0555`
Add a file spec to create a chroot directory structure for a BIND name server. This file is not being used yet, but will be soon. 2004-09-27 08:15:34 +00:00			`..`
			`etc`
gshapiro assures me that uid bind is not necessary for /etc/namedb, so we'll use the more secure default till I have a chance to prove myself wrong. :) Add a /var/stats directory to be enabled in named.conf. Submitted by: gshapiro 2004-09-29 03:35:49 +00:00			`namedb`
Create a separate directory for dynamic zones which is owned by the bind user (for creation of the zone journal file). This is separate from the master/ directory for security. Give an example dynamic zone in the sample named.conf. Approved by: dougb Noticed by: Eivind Olsen <eivind at aminor.no> MFC after: 1 week 2004-11-04 05:24:29 +00:00			`dynamic uname=bind`
			`..`
Add a file spec to create a chroot directory structure for a BIND name server. This file is not being used yet, but will be soon. 2004-09-27 08:15:34 +00:00			`master`
			`..`
Create a named chroot directory structure in /var/named, and use it by default when named is enabled. Also, improve our default directory layout by creating /var/named/etc/namedb/{master\|slave} directories, and use the former for the generated localhost* files. Rather than using pax to copy device entries, mount devfs in the chroot directory. There may be some corner cases where things need to be adjusted, but overall this structure has been well tested on a production network, and should serve the needs of the vast majority of users. UPDATING has instructions on how to do the conversion for those with existing configurations. 2004-09-28 09:46:00 +00:00			`slave uname=bind`
Add a file spec to create a chroot directory structure for a BIND name server. This file is not being used yet, but will be soon. 2004-09-27 08:15:34 +00:00			`..`
The named process needs to have a "working directory" that it can write to. This is specified in "options { directory }" in named.conf. So, create /etc/namedb/working with appropriate permissions, and update the entry in named.conf to match. In addition to specifying the working directory, file and path names in named.conf can be specified relative to the directory listed. However, since that directory is now different from /etc/namedb (where the configuration, zone, rndc.*, and other files are located) further update named.conf to specify all file names with fully qualified paths. Also update the comment about file and path names so users know this should be done for all file/path names in the file. This change will eliminate the 'working directory is not writable' messages at boot time without sacrificing security. It will also allow for features in newer versions of BIND (9.7+) to work as designed. 2009-12-15 05:14:39 +00:00			`working uname=bind`
			`..`
Add a file spec to create a chroot directory structure for a BIND name server. This file is not being used yet, but will be soon. 2004-09-27 08:15:34 +00:00			`..`
			`..`
			`/set type=dir uname=bind gname=wheel mode=0755`
			`var uname=root`
Whitespace only, tabs -> spaces, per README 2004-09-29 03:33:45 +00:00			`dump`
			`..`
Add a file spec to create a chroot directory structure for a BIND name server. This file is not being used yet, but will be soon. 2004-09-27 08:15:34 +00:00			`log`
			`..`
			`run`
Whitespace only, tabs -> spaces, per README 2004-09-29 03:33:45 +00:00			`named`
Add a file spec to create a chroot directory structure for a BIND name server. This file is not being used yet, but will be soon. 2004-09-27 08:15:34 +00:00			`..`
stats goes under /var, not /var/run 2004-09-29 03:43:10 +00:00			`..`
gshapiro assures me that uid bind is not necessary for /etc/namedb, so we'll use the more secure default till I have a chance to prove myself wrong. :) Add a /var/stats directory to be enabled in named.conf. Submitted by: gshapiro 2004-09-29 03:35:49 +00:00			`stats`
Whitespace only, tabs -> spaces, per README 2004-09-29 03:33:45 +00:00			`..`
Add a file spec to create a chroot directory structure for a BIND name server. This file is not being used yet, but will be soon. 2004-09-27 08:15:34 +00:00			`..`
			`..`