d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
freebsd-nq/contrib/bind9/doc/arm/Bv9ARM.ch02.html

159 lines
7.5 KiB
HTML
Raw Normal View History

Vendor import of BIND 9.3.2
2005-12-29 04:22:58 +00:00
<!--
Vendor import of BIND 9.4.1
2007-06-02 23:21:47 +00:00
- Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
Vendor import of BIND 9.3.2
2005-12-29 04:22:58 +00:00
- Copyright (C) 2000-2003 Internet Software Consortium.
-
- Permission to use, copy, modify, and distribute this software for any
- purpose with or without fee is hereby granted, provided that the above
- copyright notice and this permission notice appear in all copies.
-
- THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
Vendor import of 9.4.1-P1, which has fixes for the following: 1. The default access control lists (acls) are not being correctly set. If not set anyone can make recursive queries and/or query the cache contents. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925 2. The DNS query id generation is vulnerable to cryptographic analysis which provides a 1 in 8 chance of guessing the next query id for 50% of the query ids. This can be used to perform cache poisoning by an attacker. This bug only affects outgoing queries, generated by BIND 9 to answer questions as a resolver, or when it is looking up data for internal uses, such as when sending NOTIFYs to slave name servers. All users are encouraged to upgrade. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926 Approved by: re (kensmith, implicit)
2007-07-25 08:12:36 +00:00
<!-- $Id: Bv9ARM.ch02.html,v 1.13.18.18.10.1 2007/07/09 02:25:50 marka Exp $ -->
Vendor import of BIND 9.3.2
2005-12-29 04:22:58 +00:00
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Chapter<EFBFBD>2.<2E>BIND Resource Requirements</title>
Vendor import of BIND 9.4.1
2007-06-02 23:21:47 +00:00
<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
Vendor import of BIND 9.3.2
2005-12-29 04:22:58 +00:00
<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
Vendor import of BIND 9.4.1
2007-06-02 23:21:47 +00:00
<link rel="prev" href="Bv9ARM.ch01.html" title="Chapter<65>1.<2E>Introduction">
Vendor import of BIND 9.3.2
2005-12-29 04:22:58 +00:00
<link rel="next" href="Bv9ARM.ch03.html" title="Chapter<65>3.<2E>Name Server Configuration">
</head>
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
<div class="navheader">
<table width="100%" summary="Navigation header">
Vendor import of BIND 9.3.3
2006-12-10 07:09:56 +00:00
<tr><th colspan="3" align="center">Chapter<EFBFBD>2.<2E><acronym class="acronym">BIND</acronym> Resource Requirements</th></tr>
Vendor import of BIND 9.3.2
2005-12-29 04:22:58 +00:00
<tr>
<td width="20%" align="left">
<a accesskey="p" href="Bv9ARM.ch01.html">Prev</a><EFBFBD></td>
<th width="60%" align="center"><EFBFBD></th>
<td width="20%" align="right"><EFBFBD><a accesskey="n" href="Bv9ARM.ch03.html">Next</a>
</td>
</tr>
</table>
<hr>
</div>
<div class="chapter" lang="en">
<div class="titlepage"><div><div><h2 class="title">
Vendor import of BIND 9.3.3
2006-12-10 07:09:56 +00:00
<a name="Bv9ARM.ch02"></a>Chapter<EFBFBD>2.<2E><acronym class="acronym">BIND</acronym> Resource Requirements</h2></div></div></div>
Vendor import of BIND 9.3.2
2005-12-29 04:22:58 +00:00
<div class="toc">
<p><b>Table of Contents</b></p>
<dl>
Vendor import of 9.4.1-P1, which has fixes for the following: 1. The default access control lists (acls) are not being correctly set. If not set anyone can make recursive queries and/or query the cache contents. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925 2. The DNS query id generation is vulnerable to cryptographic analysis which provides a 1 in 8 chance of guessing the next query id for 50% of the query ids. This can be used to perform cache poisoning by an attacker. This bug only affects outgoing queries, generated by BIND 9 to answer questions as a resolver, or when it is looking up data for internal uses, such as when sending NOTIFYs to slave name servers. All users are encouraged to upgrade. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926 Approved by: re (kensmith, implicit)
2007-07-25 08:12:36 +00:00
<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567620">Hardware requirements</a></span></dt>
<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567646">CPU Requirements</a></span></dt>
<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567659">Memory Requirements</a></span></dt>
<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567686">Name Server Intensive Environment Issues</a></span></dt>
<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567697">Supported Operating Systems</a></span></dt>
Vendor import of BIND 9.3.2
2005-12-29 04:22:58 +00:00
</dl>
</div>
<div class="sect1" lang="en">
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
Vendor import of 9.4.1-P1, which has fixes for the following: 1. The default access control lists (acls) are not being correctly set. If not set anyone can make recursive queries and/or query the cache contents. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925 2. The DNS query id generation is vulnerable to cryptographic analysis which provides a 1 in 8 chance of guessing the next query id for 50% of the query ids. This can be used to perform cache poisoning by an attacker. This bug only affects outgoing queries, generated by BIND 9 to answer questions as a resolver, or when it is looking up data for internal uses, such as when sending NOTIFYs to slave name servers. All users are encouraged to upgrade. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926 Approved by: re (kensmith, implicit)
2007-07-25 08:12:36 +00:00
<a name="id2567620"></a>Hardware requirements</h2></div></div></div>
Vendor import of BIND 9.4.1
2007-06-02 23:21:47 +00:00
<p>
<acronym class="acronym">DNS</acronym> hardware requirements have
traditionally been quite modest.
For many installations, servers that have been pensioned off from
active duty have performed admirably as <acronym class="acronym">DNS</acronym> servers.
</p>
<p>
The DNSSEC features of <acronym class="acronym">BIND</acronym> 9
may prove to be quite
CPU intensive however, so organizations that make heavy use of these
features may wish to consider larger systems for these applications.
<acronym class="acronym">BIND</acronym> 9 is fully multithreaded, allowing
full utilization of
multiprocessor systems for installations that need it.
</p>
Vendor import of BIND 9.3.2
2005-12-29 04:22:58 +00:00
</div>
<div class="sect1" lang="en">
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
Vendor import of 9.4.1-P1, which has fixes for the following: 1. The default access control lists (acls) are not being correctly set. If not set anyone can make recursive queries and/or query the cache contents. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925 2. The DNS query id generation is vulnerable to cryptographic analysis which provides a 1 in 8 chance of guessing the next query id for 50% of the query ids. This can be used to perform cache poisoning by an attacker. This bug only affects outgoing queries, generated by BIND 9 to answer questions as a resolver, or when it is looking up data for internal uses, such as when sending NOTIFYs to slave name servers. All users are encouraged to upgrade. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926 Approved by: re (kensmith, implicit)
2007-07-25 08:12:36 +00:00
<a name="id2567646"></a>CPU Requirements</h2></div></div></div>
Vendor import of BIND 9.4.1
2007-06-02 23:21:47 +00:00
<p>
CPU requirements for <acronym class="acronym">BIND</acronym> 9 range from
i486-class machines
for serving of static zones without caching, to enterprise-class
machines if you intend to process many dynamic updates and DNSSEC
signed zones, serving many thousands of queries per second.
</p>
Vendor import of BIND 9.3.2
2005-12-29 04:22:58 +00:00
</div>
<div class="sect1" lang="en">
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
Vendor import of 9.4.1-P1, which has fixes for the following: 1. The default access control lists (acls) are not being correctly set. If not set anyone can make recursive queries and/or query the cache contents. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925 2. The DNS query id generation is vulnerable to cryptographic analysis which provides a 1 in 8 chance of guessing the next query id for 50% of the query ids. This can be used to perform cache poisoning by an attacker. This bug only affects outgoing queries, generated by BIND 9 to answer questions as a resolver, or when it is looking up data for internal uses, such as when sending NOTIFYs to slave name servers. All users are encouraged to upgrade. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926 Approved by: re (kensmith, implicit)
2007-07-25 08:12:36 +00:00
<a name="id2567659"></a>Memory Requirements</h2></div></div></div>
Vendor import of BIND 9.4.1
2007-06-02 23:21:47 +00:00
<p>
The memory of the server has to be large enough to fit the
cache and zones loaded off disk. The <span><strong class="command">max-cache-size</strong></span>
option can be used to limit the amount of memory used by the cache,
at the expense of reducing cache hit rates and causing more <acronym class="acronym">DNS</acronym>
traffic.
Additionally, if additional section caching
(<a href="Bv9ARM.ch06.html#acache" title="Additional Section Caching">the section called &#8220;Additional Section Caching&#8221;</a>) is enabled,
the <span><strong class="command">max-acache-size</strong></span> can be used to
limit the amount
of memory used by the mechanism.
It is still good practice to have enough memory to load
all zone and cache data into memory &#8212; unfortunately, the best
way
to determine this for a given installation is to watch the name server
in operation. After a few weeks the server process should reach
a relatively stable size where entries are expiring from the cache as
fast as they are being inserted.
</p>
Vendor import of BIND 9.3.2
2005-12-29 04:22:58 +00:00
</div>
<div class="sect1" lang="en">
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
Vendor import of 9.4.1-P1, which has fixes for the following: 1. The default access control lists (acls) are not being correctly set. If not set anyone can make recursive queries and/or query the cache contents. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925 2. The DNS query id generation is vulnerable to cryptographic analysis which provides a 1 in 8 chance of guessing the next query id for 50% of the query ids. This can be used to perform cache poisoning by an attacker. This bug only affects outgoing queries, generated by BIND 9 to answer questions as a resolver, or when it is looking up data for internal uses, such as when sending NOTIFYs to slave name servers. All users are encouraged to upgrade. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926 Approved by: re (kensmith, implicit)
2007-07-25 08:12:36 +00:00
<a name="id2567686"></a>Name Server Intensive Environment Issues</h2></div></div></div>
Vendor import of BIND 9.4.1
2007-06-02 23:21:47 +00:00
<p>
For name server intensive environments, there are two alternative
configurations that may be used. The first is where clients and
any second-level internal name servers query a main name server, which
has enough memory to build a large cache. This approach minimizes
the bandwidth used by external name lookups. The second alternative
is to set up second-level internal name servers to make queries
independently.
In this configuration, none of the individual machines needs to
have as much memory or CPU power as in the first alternative, but
this has the disadvantage of making many more external queries,
as none of the name servers share their cached data.
</p>
Vendor import of BIND 9.3.2
2005-12-29 04:22:58 +00:00
</div>
<div class="sect1" lang="en">
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
Vendor import of 9.4.1-P1, which has fixes for the following: 1. The default access control lists (acls) are not being correctly set. If not set anyone can make recursive queries and/or query the cache contents. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925 2. The DNS query id generation is vulnerable to cryptographic analysis which provides a 1 in 8 chance of guessing the next query id for 50% of the query ids. This can be used to perform cache poisoning by an attacker. This bug only affects outgoing queries, generated by BIND 9 to answer questions as a resolver, or when it is looking up data for internal uses, such as when sending NOTIFYs to slave name servers. All users are encouraged to upgrade. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926 Approved by: re (kensmith, implicit)
2007-07-25 08:12:36 +00:00
<a name="id2567697"></a>Supported Operating Systems</h2></div></div></div>
Vendor import of BIND 9.4.1
2007-06-02 23:21:47 +00:00
<p>
ISC <acronym class="acronym">BIND</acronym> 9 compiles and runs on a large
number
of Unix-like operating system and on NT-derived versions of
Microsoft Windows such as Windows 2000 and Windows XP. For an
up-to-date
list of supported systems, see the README file in the top level
directory
of the BIND 9 source distribution.
</p>
Vendor import of BIND 9.3.2
2005-12-29 04:22:58 +00:00
</div>
</div>
<div class="navfooter">
<hr>
<table width="100%" summary="Navigation footer">
<tr>
<td width="40%" align="left">
<a accesskey="p" href="Bv9ARM.ch01.html">Prev</a><EFBFBD></td>
<td width="20%" align="center"><EFBFBD></td>
<td width="40%" align="right"><EFBFBD><a accesskey="n" href="Bv9ARM.ch03.html">Next</a>
</td>
</tr>
<tr>
Vendor import of BIND 9.4.1
2007-06-02 23:21:47 +00:00
<td width="40%" align="left" valign="top">Chapter<EFBFBD>1.<2E>Introduction<6F></td>
Vendor import of BIND 9.3.2
2005-12-29 04:22:58 +00:00
<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
<td width="40%" align="right" valign="top"><EFBFBD>Chapter<EFBFBD>3.<2E>Name Server Configuration</td>
</tr>
</table>
</div>
</body>
</html>
Reference in New Issue Copy Permalink