Starting process named as nobody

[Fabrizio Alleva]

Hi,
I want to know if someone has never started the process named (DNS process) with the user NOBODY. And which are the benefit to do it ?
I've another little things: On my machine there are some NFS file system....
I'm runnig on HPUX 11.0
Thanks a lot
Fabrizio

[Mark Greene_1]

It's not a good idea. Named has to be able to read a lot of files: /etc/resolf.conf, /etc/nsswitch.conf, /etc/hosts, /etc/named.boot (or /etc/named.conf) and all your DNS files.

You'll also run into directory permissions in /var/run.

HTH
mark

[Sachin Patel]

I try to run it as user named on linux system but start having trouble and then when I start using root I have no more trouble.

Sachin

[Mike Hassell]

Fabrizio,

From what I've read it's good practice to Run BIND with minimum privileges: as a non-root user, with a tight umask. Take a look at the following paper that describes a secure install on Solairs:

http://www.boran.com/security/sp/bind_hardening8.html

If you are trying to further secure your BIND installation, I would recommend the following:

1. Create a user and group account for BIND (named:named)

2. Don't allow the BIND account to use ftp (/etc/ftpusers)

3. Set up file permissions on all assoicated named files and directories.

The paper further describes these steps.

Hope that helps.

-Mike

[T G Manikandan]

Hello,
You are telling that you have some NFS file systems.
Might be someone has started some processes from that.
Whenever you access a remote file system you are assigned as user nobody.

Thanks