Re: [cobalt-security] profile of a bind worm

["Kevin D" <kdlists@xxxxxxxxxxxxxxx>]

From: "Robson Martins" <robson@xxxxxxxxxxxxx>

> Hey all, i have bind-8.2.3 running here, my question is, when i run it
with
> start it is the user named but if i restart, it gets the root username, is
> it a problem? Can i receive a worm with this problem? Named need always
run
> as named? Restart is really affecting the username?

How are you restarting? your /etc/rc.d/init.d/named script should have this
in the start section:

daemon named -u named -g named

Which should start bind as user named if you do this:

/etc/rc.d/init.d/named stop
/etc/rc.d/init.d/named start

Bind running as root is a problem, but less of a problem if you have ver
8.2.3. If a new bind vulnerability is discovered for ver 8.2.3, a hacker
could easily gain root access to your box. What saved me from the worst
effects of a bind worm was bind running as named instead of root.

Kevin