Re: [CentOS] bind vs. bind-chroot

2017-04-13 Thread Robert Moskowitz
On 04/13/2017 12:11 PM, Leon Fauster wrote: Am 13.04.2017 um 17:40 schrieb Valeri Galtsev : On Thu, April 13, 2017 3:05 am, Nicolas Kovacs wrote: Le 13/04/2017 à 04:27, Robert Moskowitz a écrit : But make sure to have SELinux enabled if you do not run it chrooted. I have mine running that

Re: [CentOS] bind vs. bind-chroot

2017-04-13 Thread Leon Fauster
> Am 13.04.2017 um 17:40 schrieb Valeri Galtsev : > > > On Thu, April 13, 2017 3:05 am, Nicolas Kovacs wrote: >> Le 13/04/2017 à 04:27, Robert Moskowitz a écrit : >>> But make sure to have SELinux enabled if you do not run it chrooted. >>> >>> I have mine running that way. >> >> I bluntly admit

Re: [CentOS] bind vs. bind-chroot

2017-04-13 Thread Valeri Galtsev
On Thu, April 13, 2017 3:05 am, Nicolas Kovacs wrote: > Le 13/04/2017 à 04:27, Robert Moskowitz a écrit : >> But make sure to have SELinux enabled if you do not run it chrooted. >> >> I have mine running that way. > > I bluntly admit not using SELinux, because until now, I mainly used more > bone-

Re: [CentOS] bind vs. bind-chroot

2017-04-13 Thread Alice Wonder
On 04/13/2017 03:15 AM, Robert Moskowitz wrote: On 04/13/2017 04:23 AM, Alice Wonder wrote: On 04/13/2017 01:05 AM, Nicolas Kovacs wrote: Le 13/04/2017 à 04:27, Robert Moskowitz a écrit : But make sure to have SELinux enabled if you do not run it chrooted. I have mine running that way. I

Re: [CentOS] bind vs. bind-chroot

2017-04-13 Thread Robert Moskowitz
On 04/13/2017 04:23 AM, Alice Wonder wrote: On 04/13/2017 01:05 AM, Nicolas Kovacs wrote: Le 13/04/2017 à 04:27, Robert Moskowitz a écrit : But make sure to have SELinux enabled if you do not run it chrooted. I have mine running that way. I bluntly admit not using SELinux, because until no

Re: [CentOS] bind vs. bind-chroot

2017-04-13 Thread Robert Moskowitz
On 04/13/2017 04:05 AM, Nicolas Kovacs wrote: Le 13/04/2017 à 04:27, Robert Moskowitz a écrit : But make sure to have SELinux enabled if you do not run it chrooted. I have mine running that way. I bluntly admit not using SELinux, because until now, I mainly used more bone-headed systems that

Re: [CentOS] bind vs. bind-chroot

2017-04-13 Thread Alice Wonder
On 04/13/2017 01:05 AM, Nicolas Kovacs wrote: Le 13/04/2017 à 04:27, Robert Moskowitz a écrit : But make sure to have SELinux enabled if you do not run it chrooted. I have mine running that way. I bluntly admit not using SELinux, because until now, I mainly used more bone-headed systems that

Re: [CentOS] bind vs. bind-chroot

2017-04-13 Thread Nicolas Kovacs
Le 13/04/2017 à 04:27, Robert Moskowitz a écrit : > But make sure to have SELinux enabled if you do not run it chrooted. > > I have mine running that way. I bluntly admit not using SELinux, because until now, I mainly used more bone-headed systems that didn't implement it. Maybe this is the right

Re: [CentOS] bind vs. bind-chroot

2017-04-12 Thread Nicolas Kovacs
Le 13/04/2017 à 00:18, John R Pierce a écrit : > > bind went through a rocky stage where there were a LOT of security holes > in it. by running it in a chroot, you limit its ability to be used as a > hacking point of entry.recent versions of bind (basicially, 9 and > newer) are much more secu

Re: [CentOS] bind vs. bind-chroot

2017-04-12 Thread Robert Moskowitz
On 04/12/2017 06:18 PM, John R Pierce wrote: On 4/12/2017 3:11 PM, Nicolas Kovacs wrote: On my public servers, I usually run BIND for DNS. I see CentOS offers a preconfigured (sort of) bind-chroot package. I wonder what's the effective benefit of this vs. a "normal" BIND setup without chroot.

Re: [CentOS] bind vs. bind-chroot

2017-04-12 Thread John R Pierce
On 4/12/2017 3:11 PM, Nicolas Kovacs wrote: On my public servers, I usually run BIND for DNS. I see CentOS offers a preconfigured (sort of) bind-chroot package. I wonder what's the effective benefit of this vs. a "normal" BIND setup without chroot. On my Slackware servers, I have a rather Keep-It

[CentOS] bind vs. bind-chroot

2017-04-12 Thread Nicolas Kovacs
Hi, On my public servers, I usually run BIND for DNS. I see CentOS offers a preconfigured (sort of) bind-chroot package. I wonder what's the effective benefit of this vs. a "normal" BIND setup without chroot. On my Slackware servers, I have a rather Keep-It-Simple approach to all things security,