Opened 7 years ago

Closed 6 years ago

Last modified 6 years ago

#43006 closed enhancement (fixed)

bind9 portfile improvements

Reported by: jul_bsd@… Owned by: danielluke (Daniel J. Luke)
Priority: Normal Milestone:
Component: ports Version: 2.2.1
Keywords: haspatch Cc:
Port: bind9

Description

  • create and use dedicated user
  • include in notes a reminder to generate rdnc key for administration
  • url for documentation to secure bind
  • livecheck

Attachments (2)

patch-bind9-Portfile.diff (1.3 KB) - added by jul_bsd@… 7 years ago.
patch-bind9-Portfile.2.diff (5.8 KB) - added by jul_bsd@… 7 years ago.

Download all attachments as: .zip

Change History (13)

Changed 7 years ago by jul_bsd@…

Attachment: patch-bind9-Portfile.diff added

comment:1 Changed 7 years ago by danielluke (Daniel J. Luke)

Owner: changed from macports-tickets@… to dluke@…
Status: newassigned

comment:2 Changed 7 years ago by jul_bsd@…

  • port lint --nitpick
  • livecheck
  • /tab/spacex4/

Changed 7 years ago by jul_bsd@…

Attachment: patch-bind9-Portfile.2.diff added

comment:3 Changed 7 years ago by danielluke (Daniel J. Luke)

Status: assignednew

I'm unlikely to integrate the WS changes, but adding a dedicated user for bind9 is a good idea.

comment:4 Changed 7 years ago by danielluke (Daniel J. Luke)

Status: newassigned

comment:5 Changed 7 years ago by danielluke (Daniel J. Luke)

Cc: dluke@… removed

comment:6 Changed 7 years ago by danielluke (Daniel J. Luke)

Are you running with this config? I would think some of the files/paths would need to be owned by the new user/group in order for this to actually work.

comment:7 Changed 7 years ago by jul_bsd@…

  • what do you mean by WS changes?
  • I have some bind9 warnings about permissions: /opt/local/var/run/named.pid /opt/local/var/run/named/session.key. it does not seem possible to specify a pid path at run to use a named-owned dir, need to review that, maybe at configure
  • it runs on a desktop client. it was mostly for my cif setup (#43011) but other things are blocking my test currently

comment:8 Changed 7 years ago by danielluke (Daniel J. Luke)

  • WS = whitespace
  • we probably need to put the pid into something like $prefix/var/run/named/named.pid where $prefix/var/run/named is owned by the new named user. I imagine $prefix/var/named needs to be installed owned by named as well (especially for anyone doing auto-dnssec). We could probably put the pid in $prefix/var/named otherwise too...
  • for a local caching resolver, I would honestly probably recommend that people run unbound instead of bind9

comment:9 Changed 7 years ago by jul_bsd@…

  • tab to whitespace seems the "norm" defined by 'port lint --nitpick' after, I don't mind other. depends on macport policy
  • yeah, I agree about pid, just need to check where we defined the path. doesn't seem to be at run (nothing in man), so maybe in config file (pid-file, it seems)
  • unbound is lighter and probably more secure for a default local resolver after, it depends on the requirements of other software... as for cif, it seems mostly for cache+forwarder, so probably possible with unbound

comment:10 Changed 6 years ago by danielluke (Daniel J. Luke)

Resolution: fixed
Status: assignedclosed

r119626

  • use add_users to add new user/group
  • use new user as owner of some installed files
  • include the extra notes text you recommended

r119628

  • move pidfile to where I meant to move it
  • add livecheck
  • actually tell startupitem.executable to use the new named user
Last edited 6 years ago by danielluke (Daniel J. Luke) (previous) (diff)

comment:11 Changed 6 years ago by jul_bsd@…

Thanks dlduke@

Note: See TracTickets for help on using tickets.