Re: Comments re ISC's announcement on bind9 security
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Tim,
> On another note, why is it that everyone arguing the all-or-nothing case
> likes to ignore the other very-usable-now mitigation of randomizing
> source ports? I don't use BIND and I don't care to check it's current
> behavior, but has the ISC finally gotten around to randomizing the
> source ports? If not, why not? The extra few bits of entropy can go a
> long way, particularly if a good PRNG is used.
Yes, ISC has finally gotten around to randomizing the source ports, as of
9.5.0a2. It is controlled by the "use-queryport-pool" option in the server
section of the BIND configuration file. It defaults to "yes".
You can control how big the pool is with the "queryport-pool-ports" option. It
defaults to 8 (an extra 3 bits of entropy).
This set of ports is refreshed periodically, with a frequency controlled by the
"queryport-pool-updateinterval" option. (Personally I think this option adds no
little value from a security point of view, but it doesn't hurt.)
- --
Shane
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFHKv/gMsfZxBO4kbQRAq0KAJ4h0r4x1GMsucrfkRxptywSCzONxwCfc4U/
gRtVT40M1wud2wlviLwoQ9c=
=EQk/
-----END PGP SIGNATURE-----