<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On Apr 15, 2011, at 9:29 AM, hugo hugoo wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div class="hmmessage" style="font-size: 10pt; font-family: Tahoma; ">I do not use the version provided bu Debian because I am migrating from bind8 to Bind9 and I wan to have both versions available on the same server.<br>So, I want to have Bind9 totally separated from Bind8.<br> <br>I use Debian, version 5 and the last ESV bind9.<br> <br>- I have seen that in the debian distribution, bind9 is started via "named -u bind" ==> is it dangerous to run bind9 as root?<br></div></span></blockquote><div><br></div><div>It is dangerous to run anything as root, "named", "httpd", etc. This includes running anything you do on the console as root, unless it is absolutely necessary.</div><div><br></div><div>This is why software that requires root access to start up, such as BIND, is written such that it is easy to run as a non-privileged user. Information about using this is included in the ARM, basically making sure that the necessary files/directories are readable (and maybe writable) by the identified user. Easy enough that doing anything else is simply foolish.</div><br><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div class="hmmessage" style="font-size: 10pt; font-family: Tahoma; "> - The following script is provided i nthe distribution to start/stop bind9.<br> But I hesitate to copy it to use it with a source installation.<br> <br>lennydnstest01:~# cat /etc/init.d/bind9<br>#!/bin/sh<br>### BEGIN INIT INFO<br># Provides: bind9<br># Required-Start: $remote_fs<br># Required-Stop: $remote_fs<br># Should-Start: $network $syslog<br># Should-Stop: $network $syslog<br># Default-Start: 2 3 4 5<br># Default-Stop: 0 1 6<br># Short-Description: Start and stop bind9<br># Description: bind9 is a Domain Name Server (DNS)<br># which translates ip addresses to and from internet names<br>### END INIT INFO<br>PATH=/sbin:/bin:/usr/sbin:/usr/bin<br># for a chrooted server: "-u bind -t /var/lib/named"<br># Don't modify this line, change or create /etc/default/bind9.<br>OPTIONS=""<br>RESOLVCONF=no<br>test -f /etc/default/bind9 && . /etc/default/bind9<br>test -x /usr/sbin/rndc || exit 0<br>. /lib/lsb/init-functions<br>DISTRO=$(lsb_release -is 2>/dev/null || echo Debian)<br>PIDFILE=/var/run/bind/run/named.pid<br>check_network() {<br> if [ -x /usr/bin/uname ] && [ "X$(/usr/bin/uname -o)" = XSolaris ]; then<br> IFCONFIG_OPTS="-au"<br> else<br> IFCONFIG_OPTS=""<br> fi<br> if [ -z "$(/sbin/ifconfig $IFCONFIG_OPTS)" ]; then<br> #log_action_msg "No networks configured."<br> return 1<br> fi<br> return 0<br>}<br>case "$1" in<br> start)<br> log_daemon_msg "Starting domain name service..." "bind9"<br> modprobe capability >/dev/null 2>&1 || true<br> # dirs under /var/run can go away on reboots.<br> mkdir -p /var/run/bind/run<br> chmod 775 /var/run/bind/run<br> chown root:bind /var/run/bind/run >/dev/null 2>&1 || true<br> if [ ! -x /usr/sbin/named ]; then<br> log_action_msg "named binary missing - not starting"<br> log_end_msg 1<br> exit 1<br> fi<br> if ! check_network; then<br> log_end_msg 1<br> exit 1<br> fi<br>echo $OPTIONS;<br> if start-stop-daemon --start --oknodo --quiet --exec /usr/sbin/named \<br> --pidfile ${PIDFILE} -- $OPTIONS; then<br> if [ "X$RESOLVCONF" != "Xno" ] && [ -x /sbin/resolvconf ] ; then<br> echo "nameserver 127.0.0.1" | /sbin/resolvconf -a lo.named<br> fi<br> log_end_msg 0<br> else<br> log_end_msg 1<br> fi<br> ;;<br> stop)<br> log_daemon_msg "Stopping domain name service..." "bind9"<br> if ! check_network; then<br> log_end_msg 1<br> exit 1<br> fi<br> if [ "X$RESOLVCONF" != "Xno" ] && [ -x /sbin/resolvconf ] ; then<br> /sbin/resolvconf -d lo.named<br> fi<br> pid=$(/usr/sbin/rndc stop -p | awk '/^pid:/ {print $2}')<br> if [ -n "$pid" ]; then<br> while kill -0 $pid 2>/dev/null; do<br> log_progress_msg "waiting for pid $pid to die"<br> sleep 1<br> done<br> fi<br> log_end_msg $?<br> ;;<br> reload|force-reload)<br> log_daemon_msg "Reloading domain name service..." "bind9"<br> if ! check_network; then<br> log_end_msg 1<br> exit 1<br> fi<br> /usr/sbin/rndc reload >/dev/null<br> log_end_msg $?<br> ;;<br> restart)<br> if ! check_network; then<br> exit 1<br> fi<br> $0 stop<br> $0 start<br> ;;<br> <span class="Apple-converted-space"> </span><br> status)<br> ret=0<br> status_of_proc -p ${PIDFILE} /usr/sbin/named bind9 2>/dev/null || ret=$?<br> ;;<br> *)<br> log_action_msg "Usage: /etc/init.d/bind9 {start|stop|reload|restart|force-reload|status}"<br> exit 1<br> ;;<br>esac<br>exit 0<br></div></span></blockquote><div><br></div><div>Wow, this does a lot of stuff, everything but putting out the cat at night! So much that it makes me a little leery of it. I like to know exactly what is occurring when running something, but this is a difference in administration styles.</div><div><br></div><div>This is the Debian supplied "bind9" etc script. Why not copy and re-name this to something else such that it doesn't conflict with the Debian startup scripts. Then you can configure it how you want and need and not worry about getting clobbered with updates from Debian.</div><div><br></div><div>Bill Larson</div></div></body></html>