Hey everyone and welcome back. So now what I want to talk to you about is again related
to the security of your system with respect to your DNS configuration. What we're now
going to do is discuss sending binds to jail, which sounds pretty dramatic, but the reality
is it's not so dramatic. It's just a cool little configuration to protect your internal
system with respect to your DNS configuration. So let's actually talk about how it works
and the main components that we have to know for the LPIC2 examination. When you happen
to be exposing a DNS server, there is no way around it. The DNS server, like all applications,
can be vulnerable. Now of course you try your best to shore up your security to minimise
this possibility, but the reality is with respect to computer systems, vulnerable software
is always a possibility. Now what happens if this vulnerable software is compromised?
And this is what we're really trying to plan for. We're not going to plan for an impenetrable
DNS server that is not realistic. What we want to do is you want to plan for the event that
the DNS server becomes compromised. How can we limit the blast radius? How can we limit
the damage that that would cause to our internal system? So here is the deal. Imagine that
our DNS server was compromised by an attacker. Okay. So they now have access to this system.
And what that potentially means is that they have access to our file system. So you'll
notice that particular file, say for example within the Etsy directory, if we scroll on
up things like our password file, look at the permissions right here, even though the
person on the system is not the root user, anyone could still ultimately read this file
if they had access to the system. So even if the person who compromised the server was
not able to get root access, just by being able to access the file system, they could
potentially read some sensitive files. So what we want to do is we want to implement something
known as CH root. This is going to allow us to effectively change our root file system
or at least the appearance of our root file system relative to the bind nine daemon. So
really what is going to happen is that our name d service is going to be locked down
in such a way that the service itself can only see files related to the service. So think
about it like this. Let me cd to my root directory and I'll do an LS dash L. So here is our generic
file system. As we know, we have the root and then branching off. We have all of these other
directories such as the bin directory and the boot directory, so on so forth all the
way down. Now what we want to do is we want to create a subdirectory structure that mirrors
this structure within a particular file. Now again, this might sound a little bit confusing.
Let's see what I mean in action then. So let's say we had configuration files within our root
directory. We would go into the etsy directory and then bind and then within here we could
have something like say named dot comf as we've seen before. Okay, what we would actually want
to do is we would want to create our own directory structure. So like I say, we could actually
have a directory called ch root slash name d and then within this directory structure, we could
just mirror this type of structure. So we go in and do it say bind and then named dot comf. So
what we do is we create this directory structure right here and we configure our system in such a
way that the bind daemon only can actually see what is within this directory structure. So really
when it looks in, it actually sees this as the root of the directory, this part right here, and it
can't actually break out from within this directory structure. That means that when we want to be
able to access our bind configuration files, we go through etsy bind named dot comf. We still
can do this, but when say for example, an attacker may compromise our bind server, when they are
safe, for example, within the etsy directory here, they're not going to be able to see this password
file that we talked about. So let me show you what I mean here. Okay, so what I will do here is I
will say mkdir dash p forward slash ch root forward slash named d. Oh, and of course need my
super user privileges. Okay, so if I now go to the root of my directory and do a long listing,
notice now we actually have this new folder here ch root. If we go into this directory, we do an
ls, we now have named d. And within here, what we want to do is to basically recreate the directory
structure for all the folders and sub folders that the bind service needs to operate. So things
like, you know, the etsy directory, we could do mkdir etsy. Of course, need to do so, though, I
could do mkdir make the dev directory and again, super user privileges. And I could do the mkdir
var directory. So within here, we are ultimately recreating the directory structure. And what
we're going to do is we're going to point our bind configuration to this particular folder
structure. And it's going to be in such a way that the bind service will never be able to break
out of this directory structure. So basically, if someone compromises the system, this here is going
to look like the root directory structure, whereby the root is actually encased within this
particular directory. Now how in earth do we actually get our service to see this particular
file or this particular location as the root directory? Well, what I'll do is I'll go to my
root file system. Here we are right here. I'll go into the etsy directory, I'll go into the default
directory. And notice I have this configuration file called bind, let me do sudo nano bind nine.
Let's go in here. And within here, what I want to do is do dash t to specify the top level
directory for the roots. And I will actually specify it's not the root directory, it's going to be
within ch roots, forward slash named d. And that is all it actually takes. So that means that the
bind daemon is going to be locked within this particular directory structure. So really, the
hard work here is to go through and to recreate the directory structure with all the correct
sub directories and configuration files needed for the bind server to operate. Like I say, the good
news is that once that is done, say for example, I go into the etsy directory, and I create a bind
directory like so. And I go into bind, I can create a name.conf configuration file. And again, I
just keep forgetting this sudo. There we go. As we can see here, within this directory structure, we
are mirroring everything that is actually needed at say bind. And of course, we would need our other
configuration files such as name.conf.options and local so on so forth. And like I say, anyone who
breaks into the system using that particular service will not be able to escape out of this
directory structure. The way I can right now, I can just keep moving back directories like so and get
to the real root file system. However, an attacker will not be able to do such a thing due to the
lockdown configuration of as we call it, sending bind to jail using these simple steps to protect
our system in the event that the DNS server becomes compromised. So I know this was a lot to deal
with within this skill. It definitely is one of the more challenging objectives within the LPEG2
examination. So again, I encourage you to rewatch this skill if you have to. And certainly, as
always, I recommend you try to lab up these configurations to help build your familiarity.
But for now, that is us for DNS. I hope this has been informative for you. And I'd like to thank you
for viewing.