はじめに
2016年11月頭に発表された、Bindの脆弱性対応の作業記録です。
10月に続いてまたもや更新です。
環境
現行バージョン：BIND 9.10.4-P3
更新バージョン：BIND 9.10.4-P4（最新）
OS：CentOS 5.6（ちょっと古い）
方針
構成を変えたくなかったので、上書きインストールで実施。
手順
最新ソースを入手する
- 作業前に現行バージョンの確認
# /usr/local/sbin/named -v
BIND 9.10.4-P3 <id:6b19o23>
→実際は、既存環境の設定ファイルやZONEファイルのバックアップも実施。
# cd /usr/local/src
# wget http://ftp.isc.org/isc/bind9/9.10.4-P4/bind-9.10.4-P4.tar.gz
BINDをインストールする
# cd bind-9.10.4-P4
# ./configure --with-openssl=yes --enable-shared --enable-fetchlimit
configオプションはお好みで。
openssl使わないのであれば外しても良い。
enable-fetchlimitは、DNS水責め攻撃の対策のオプションです。デフォルトで無効。
Configuration:
-h, --help display this help and exit
--help=short display options specific to this package
--help=recursive display the short help of all the included packages
-V, --version display version information and exit
-q, --quiet, --silent do not print `checking ...' messages
--cache-file=FILE cache test results in FILE [disabled]
-C, --config-cache alias for `--cache-file=config.cache'
-n, --no-create do not create output files
--srcdir=DIR find the sources in DIR [configure dir or `..']
Installation directories:
--prefix=PREFIX install architecture-independent files in PREFIX
[/usr/local]
--exec-prefix=EPREFIX install architecture-dependent files in EPREFIX
[PREFIX]
By default, `make install' will install all the files in
`/usr/local/bin', `/usr/local/lib' etc. You can specify
an installation prefix other than `/usr/local' using `--prefix',
for instance `--prefix=$HOME'.
For better control, use the options below.
Fine tuning of the installation directories:
--bindir=DIR user executables [EPREFIX/bin]
--sbindir=DIR system admin executables [EPREFIX/sbin]
--libexecdir=DIR program executables [EPREFIX/libexec]
--sysconfdir=DIR read-only single-machine data [PREFIX/etc]
--sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com]
--localstatedir=DIR modifiable single-machine data [PREFIX/var]
--libdir=DIR object code libraries [EPREFIX/lib]
--includedir=DIR C header files [PREFIX/include]
--oldincludedir=DIR C header files for non-gcc [/usr/include]
--datarootdir=DIR read-only arch.-independent data root [PREFIX/share]
--datadir=DIR read-only architecture-independent data [DATAROOTDIR]
--infodir=DIR info documentation [DATAROOTDIR/info]
--localedir=DIR locale-dependent data [DATAROOTDIR/locale]
--mandir=DIR man documentation [DATAROOTDIR/man]
--docdir=DIR documentation root [DATAROOTDIR/doc/bind]
--htmldir=DIR html documentation [DOCDIR]
--dvidir=DIR dvi documentation [DOCDIR]
--pdfdir=DIR pdf documentation [DOCDIR]
--psdir=DIR ps documentation [DOCDIR]
NOTE: If PREFIX is not set, then the default values for --sysconfdir
and --localstatedir are /etc and /var, respectively.
System types:
--build=BUILD configure for building on BUILD [guessed]
--host=HOST cross-compile to build programs to run on HOST [BUILD]
Optional Features:
--disable-option-checking ignore unrecognized --enable/--with options
--disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no)
--enable-FEATURE[=ARG] include FEATURE [ARG=yes]
--enable-shared[=PKGS] build shared libraries [default=yes]
--enable-static[=PKGS] build static libraries [default=yes]
--enable-fast-install[=PKGS]
optimize for fast installation [default=yes]
--disable-libtool-lock avoid locking (might break parallel builds)
--enable-libbind deprecated
--enable-warn-shadow turn on -Wshadow when compiling
--enable-warn-error turn on -Werror when compiling
--enable-developer enable developer build settings
--enable-seccomp enable support for libseccomp system call filtering
[default=no]
--enable-kqueue use BSD kqueue when available [default=yes]
--enable-epoll use Linux epoll when available [default=auto]
--enable-devpoll use /dev/poll when available [default=yes]
--enable-threads enable multithreading
--enable-native-pkcs11 use native PKCS11 for all crypto [default=no]
--enable-openssl-hash use OpenSSL for hash functions [default=no]
--enable-sit enable source identity token [default=no]
--enable-openssl-version-check
check OpenSSL version [default=yes]
--enable-largefile 64-bit file support
--enable-backtrace log stack backtrace on abort [default=yes]
--enable-symtable use internal symbol table for backtrace
[all|minimal(default)|none]
--enable-ipv6 use IPv6 default=autodetect
--enable-getifaddrs enable the use of getifaddrs() [yes|no].
--disable-isc-spnego use SPNEGO from GSSAPI library
--disable-chroot disable chroot
--disable-linux-caps disable linux capabilities
--enable-atomic enable machine specific atomic operations
[default=autodetect]
--enable-fixed-rrset enable fixed rrset ordering [default=no]
--disable-rpz-nsip disable rpz-nsip rules [default=enabled]
--disable-rpz-nsdname disable rpz-nsdname rules [default=enabled]
--enable-fetchlimit enable recursive fetch limits [default=no]
--enable-filter-aaaa enable filtering of AAAA records [default=no]
--enable-querytrace enable very verbose query trace logging [default=no]
--enable-full-report report values of all configure options
Optional Packages:
--with-PACKAGE[=ARG] use PACKAGE [ARG=yes]
--without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no)
--with-pic[=PKGS] try to use only PIC/non-PIC objects [default=use
both]
--with-gnu-ld assume the C compiler uses GNU ld [default=no]
--with-sysroot=DIR Search for dependent libraries within DIR
(or the compiler's sysroot if not specified).
--with-python=PATH specify path to python interpreter
--with-geoip=PATH Build with GeoIP support (yes|no|path)
--with-gssapi=PATH Specify path for system-supplied GSSAPI [default=yes]
--with-randomdev=PATH Specify path for random device
--with-locktype=ARG Specify mutex lock type (adaptive or standard)
--with-libtool use GNU libtool
--with-openssl=PATH Build with OpenSSL yes|no|path.
(Crypto is required for DNSSEC)
--with-pkcs11=PATH Build with PKCS11 support yes|no|path
(PATH is for the PKCS11 provider)
--with-ecdsa Crypto ECDSA
--with-gost Crypto GOST yes|no|raw|asn1.
--with-aes Crypto AES
--with-sit-alg=ALG choose the algorithm for SIT [aes|sha1|sha256]
--with-libxml2=PATH build with libxml2 library yes|no|path
--with-libjson=PATH build with libjson0 library yes|no|path
--with-purify=PATH use Rational purify
--with-gperftools-profiler use gperftools CPU profiler
--with-kame=PATH use Kame IPv6 default path /usr/local/v6
--with-readline=LIBSPEC specify readline library default auto
--with-docbook-xsl=PATH specify path for Docbook-XSL stylesheets
--with-idn=MPREFIX enable IDN support using idnkit default PREFIX
--with-libiconv=IPREFIX GNU libiconv are in IPREFIX default PREFIX
--with-iconv=LIBSPEC specify iconv library default -liconv
--with-idnlib=ARG specify libidnkit
--with-atf=ARG support Automated Test Framework
--with-tuning=ARG Specify server tuning (large or default)
--with-dlopen=ARG support dynamically loadable DLZ drivers
--with-dlz-postgres=PATH Build with Postgres DLZ driver yes|no|path.
(Required to use Postgres with DLZ)
--with-dlz-mysql=PATH Build with MySQL DLZ driver yes|no|path.
(Required to use MySQL with DLZ)
--with-dlz-bdb=PATH Build with Berkeley DB DLZ driver yes|no|path.
(Required to use Berkeley DB with DLZ)
--with-dlz-filesystem=ARG Build with filesystem DLZ driver yes|no.
(Required to use file system driver with DLZ)
--with-dlz-ldap=PATH Build with LDAP DLZ driver yes|no|path.
(Required to use LDAP with DLZ)
--with-dlz-odbc=PATH Build with ODBC DLZ driver yes|no|path.
(Required to use ODBC with DLZ)
--with-dlz-stub=ARG Build with stub DLZ driver yes|no.
(Required to use stub driver with DLZ)
--with-make-clean run "make clean" at end of configure [yes|no]
そのままmakeして、namedサービスを停止してインストールを実行する。
インストールが完了したらBINDのバージョンを確認してアップデートが成功した事を確認する。
# make
# etc/init.d/named stop
# ps aux | grep named | grep -v grep
# make install
# rndc
Version: 9.10.4-P4
make installはハードのスペックによって時間が変わります。
こんな時だけオンプレ環境で良かったと思いました。
BINDを起動して動作を確認する
# /etc/init.d/named start
# ps aux | grep named | grep -v grep
→プロセス起動の確認
# netstat -tnlp
→Listenポートの確認
# rndc status
version: BIND 9.10.4-P4 <id:123xa4b> ()
boot time: Fri, 15 Nov 2016 05:30:12 GMT
last configured: Fri, 09 Nov 2016 08:53:14 GMT
CPUs found: 4
worker threads: 4
UDP listeners per interface: 3
number of zones: 100
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is ON
recursive clients: 0/900/1000
tcp clients: 0/100
server is up and running
→BINDステータスの確認
特に問題なし。無事完了。
諸々と確認しておいた事
その１）本当に名前解決できるのか。
# dig +noall +answer @localhost www.yahoo.co.jp
www.yahoo.co.jp. 900 IN CNAME www.g.yahoo.co.jp.
www.g.yahoo.co.jp. 60 IN A 183.79.104.227
www.g.yahoo.co.jp. 60 IN A 183.79.143.229
www.g.yahoo.co.jp. 60 IN A 183.79.143.228
www.g.yahoo.co.jp. 60 IN A 182.22.121.124
実際は自分が所有しているZONEやREVに対しても実施。
その２）master-slaveの転送ができるか確認。
試験用のZONEファイルを更新して、
# vi /var/named/zone/test.zone
test IN A 192.168.2.10
master側でreload、slave側でretransferを実行する。
# rndc reload test-domain.net
# rndc retransfer test-domain.net
さらにログも見つつ、slave側に更新が反映される事を確認する。
# tail -f /var/log/named.log
これで無事アップデート完了です。
何回もアップデートを実施する機会があるので、簡単にできると嬉しいです。
（早くrpmでの更新に変更したいです）
最後に
rpmへの移行やセキュリティに対応した設定の仕方など機会があればまた書きたいと思います。