<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>
<div>Yes you can run without the chroot. Years ago it was considered best practice to chroot and most power users would have said you were insane not to do so. Now there are increasingly many who say it's not worth the effort (fairly easy to get around in
many cases) -- do a bit of google engineering and you will see pros/cons.</div>
</div>
</div>
<div><br>
</div>
<div>If you are using packages from your distro (looks like it from the "el6" and ancient version) this will often just be pulled in by default. If you build your own packages, use upstream repos, ISC packages or something like this:</div>
<div><br>
</div>
<div>http://www.five-ten-sg.com/mapper/bind</div>
<div><br>
</div>
<div>Then you can just install without the chroot. Entirely up to you, BIND can work either way. As I said, if you search a bit you'll find older "best practices" like these which suggest chroot (note the dates!):</div>
<div><br>
</div>
<div>https://www.cymru.com/Documents/secure-bind-template.html</div>
<div><br>
</div>
<div>https://deepthought.isc.org/article/AA-00768/0/Getting-started-with-BIND-how-to-build-and-run-named-with-a-basic-recursive-configuration.html</div>
<div><br>
</div>
<div>Then increasing amounts of documentation saying it is largely irrelevant due to adding minimal value due to some known issues in the chroot mechanism itself, named -u, etc:</div>
<div><br>
</div>
<div>https://deepthought.isc.org/article/AA-00874/0</div>
<div><br>
</div>
<div>"""</div>
<div>If following the preceding advice (running <acronym class="term" title="BIND is a DNS server product produced by ISC. BIND 9 is currently the stable production version, while BIND 10 is nearing production quality. BIND is an acronym for Berkeley Internet Name Domain, although many incorrectly call it Berkeley Internet Name Daemon.">
BIND</acronym> as an unprivileged user on a dedicated server) chrooting is "de-emphasized." Our operations experts feel that chrooting does not substantially improve security under those conditions and do not affirmatively recommend it, but they do not explicitly
discourage it.</div>
<div>"""</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span><<a href="mailto:bind-users-bounces@lists.isc.org">bind-users-bounces@lists.isc.org</a>> on behalf of Harshith Mulky <<a href="mailto:harshith.mulky@outlook.com">harshith.mulky@outlook.com</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, January 14, 2016 at 1:46 AM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>" <<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>><br>
<span style="font-weight:bold">Subject: </span>What is the use of having a chroot path during installation of Bind<br>
</div>
<div><br>
</div>
<div><style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hello,</p>
<p><br>
</p>
<p>When installing bind, the following 2 are installed</p>
<p><br>
</p>
<p>bind-9.8.2-0.17.rc1.el6.x86_64<br>
bind-chroot-9.8.2-0.17.rc1.el6.x86_64<br>
</p>
<p><br>
</p>
<p>What is the need of this bind-chroot?</p>
<p><br>
</p>
<p><br>
</p>
<p>I see all files in /var/named path are softlinks to /var/named/chroot/var/named</p>
<p><br>
</p>
<p>and</p>
<p><br>
</p>
<p>/etc/named.conf is softlink to /var/named/chroot/etc/named.conf</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p>What is this chroot binding? And why is this chroot Binding Required?</p>
<p><br>
</p>
<p><br>
</p>
<p>Can the named server function without this chroot Binding?</p>
<p><br>
</p>
<p><br>
</p>
<p>Thanks</p>
<p>Harshith<br>
</p>
</div>
</div>
</div>
</span>
</body>
</html>