The syslog daemon

Securing and Optimizing Linux: RedHat Edition -A Hands on Guide
Prev | Chapter 21. Software -Networking | Next

# 21.7. The syslog daemon

We must tell syslogd the syslog daemon program about the new chrooted service, since normally, processes talk to syslogd through `/dev/log`. As a result of the chroot jail, this won't be possible, so syslogd needs to be told to listen to `/chroot/named/dev/log` instead of the default `dev/log`. To do this, edit the syslog startup script file to specify additional places to listen.

Edit the `syslog` script file vi +24 `/etc/rc.d/init.d/syslog` and change the line:

     daemon syslogd -m 0

To read:

     daemon syslogd -m 0 -a /chroot/named/dev/log

The default named script file of ISC BIND/DNS starts the daemon `named` outside the chroot jail. We must change it to start named from the chroot jail. Edit the named script file vi `/etc/rc.d/init.d/named` and change the lines:

1.      [ -f /usr/sbin/named ] || exit 0

   To read:

        [ -f /chroot/named/usr/sbin/named ] || exit 0

2.      [ -f /etc/named.conf ] || exit 0

   To read:

        [ -f /chroot/named/etc/named.conf ] || exit 0

3.      daemon named

   To read:

        daemon /chroot/named/usr/sbin/named -t /chroot/named/ -unamed -gnamed

The -t

  option tells `named` to start up using the new chroot environment.

The -u

  option specifies the user to run as.

The -g

  option specifies the group to run as.

In BIND 8.2 version, the ndc command of ISC BIND/DNS software became a binary file; before, it was a script file, which renders the shipped ndc useless in this setting. To fix it, the ISC BIND/DNS package must be compiled again from source. To do this, in the top level of ISC BIND/DNS source directory.

1. For ndc utility:

        [root@deep] /# cp bind-src.tar.gz /vat/tmp
        [root@deep] /# cd /var/tmp/
        [root@deep ]/tmp# tar xzpf bind-src.tar.gz
        [root@deep ]/tmp# cd src
        [root@deep ]/src# cp port/linux/Makefile.set port/linux/Makefile.set-orig

2. Edit the `Makefile.set file`, vi `port/linux/Makefile.set` to make the changes listed below:

        'CC=egcs -D_GNU_SOURCE'
        'CDEBUG=-O9 -funroll-loops -ffast-math -malign-double -mcpu=pentiumpro -march=pentiumpro -fomit-frame-pointer -fno-exceptions -g
        'DESTBIN=/usr/bin'
        'DESTSBIN=/chroot/named/usr/sbin'
        'DESTEXEC=/chroot/named/usr/sbin'
        'DESTMAN=/usr/man'
        'DESTHELP=/usr/lib'
        'DESTETC=/etc'
        'DESTRUN=/chroot/named/var/run'
        'DESTLIB=/usr/lib/bind/lib'
        'DESTINC=/usr/lib/bind/include'
        'LEX=flex -8 -I'
        'YACC=yacc -d'
        'SYSLIBS=-lfl'
        'INSTALL=install'
        'MANDIR=man'
        'MANROFF=cat'
        'CATEXT=$$N'
        'PS=ps p'
        'AR=ar crus'
        'RANLIB=:'

3. The difference between the Makefile we used before and this one is that we modify the `DESTSBIN=`, `DESTEXEC=`, and `DESTRUN=` lines to point to the chrooted directory of BIND/DNS. With this modification, the ndc program knows where to find `named`.

        [root@deep ]/src# make clean
        [root@deep ]/src# make
        [root@deep ]/src# cp bin/ndc/ndc /usr/sbin/
        [root@deep ]/src# cp: overwrite `/usr/sbin/ndc'? y
        [root@deep ]/src# strip /usr/sbin/ndc

   We build the binary file, then copy the result of ndc program to `/usr/sbin` and overwrite the old one. We dont forget to strip our new ndc binary for better performance.

Prev | Home | Next
Run ISC BIND/DNS in a chroot jail | Up | Clean-up and Test the new chrooted jail