B.5. 修改Bind默认安装的示例脚本.

This script automates the procedure for changing the bind version 8 name server’s default installation so that it does not run as the superuser. Notice that bind version 9 in Debian already does this by default [78] , and you are much better using that version than bind version 8.

This script is here for historical purposes and to show how you can automate this kind of changes system-wide. The script will create the user and groups defined for the name server and will modify both /etc/default/bind and /etc/init.d/bind so that the program will run with that user. Use with extreme care since it has not been tested thoroughly.

You can also create the users manually and use the patch available for the default init.d script attached to http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=157245.

  1. #!/bin/sh
  2. # Change the default Debian bind v8 configuration to have it run
  3. # with a non-root user and group.
  4. #
  5. # DO NOT USER this with version 9, use debconf for configure this instead
  6. #
  7. # WARN: This script has not been tested thoroughly, please
  8. # verify the changes made to the INITD script
  9.  
  10. # (c) 2002 Javier Fernandez-Sanguino Pena
  11. #
  12. # This program is free software; you can redistribute it and/or modify
  13. # it under the terms of the GNU General Public License as published by
  14. # the Free Software Foundation; either version 1, or (at your option)
  15. # any later version.
  16. #
  17. # This program is distributed in the hope that it will be useful,
  18. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  19. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  20. # GNU General Public License for more details.
  21. #
  22. # Please see the file `COPYING' for the complete copyright notice.
  23. #
  24.  
  25. restore() {
  26. # Just in case, restore the system if the changes fail
  27. echo "WARN: Restoring to the previous setup since I'm unable to properly change it."
  28. echo "WARN: Please check the $INITDERR script."
  29. mv $INITD $INITDERR
  30. cp $INITDBAK $INITD
  31. }
  32.  
  33.  
  34. USER=named
  35. GROUP=named
  36. INITD=/etc/init.d/bind
  37. DEFAULT=/etc/default/bind
  38. INITDBAK=$INITD.preuserchange
  39. INITDERR=$INITD.changeerror
  40. AWKS="awk ' /\/usr\/sbin\/ndc reload/ { print \"stop; sleep 2; start;\"; noprint = 1; } /\\\\$/ { if ( noprint != 0 ) { noprint = noprint + 1;} } /^.*$/ { if ( noprint != 0 ) { noprint = noprint - 1; } else { print \$0; } } '"
  41.  
  42. [ `id -u` -ne 0 ] && {
  43. echo "This program must be run by the root user"
  44. exit 1
  45. }
  46.  
  47. RUNUSER=`ps eo user,fname |grep named |cut -f 1 -d " "`
  48.  
  49. if [ "$RUNUSER" = "$USER" ]
  50. then
  51. echo "WARN: The name server running daemon is already running as $USER"
  52. echo "ERR: This script will not do any changes to your setup."
  53. exit 1
  54. fi
  55. if [ ! -f "$INITD" ]
  56. then
  57. echo "ERR: This system does not have $INITD (which this script tries to change)"
  58. RUNNING=`ps eo fname |grep named`
  59. [ -z "$RUNNING" ] && \
  60. echo "ERR: In fact the name server daemon is not even running (is it installed?)"
  61. echo "ERR: No changes will be made to your system"
  62. exit 1
  63. fi
  64.  
  65. # Check if there are options already setup
  66. if [ -e "$DEFAULT" ]
  67. then
  68. if grep -q ^OPTIONS $DEFAULT; then
  69. echo "ERR: The $DEFAULT file already has options set."
  70. echo "ERR: No changes will be made to your system"
  71. fi
  72. fi
  73.  
  74. # Check if named group exists
  75. if [ -z "`grep $GROUP /etc/group`" ]
  76. then
  77. echo "Creating group $GROUP:"
  78. addgroup $GROUP
  79. else
  80. echo "WARN: Group $GROUP already exists. Will not create it"
  81. fi
  82. # Same for the user
  83. if [ -z "`grep $USER /etc/passwd`" ]
  84. then
  85. echo "Creating user $USER:"
  86. adduser --system --home /home/$USER \
  87. --no-create-home --ingroup $GROUP \
  88. --disabled-password --disabled-login $USER
  89. else
  90. echo "WARN: The user $USER already exists. Will not create it"
  91. fi
  92.  
  93. # Change the init.d script
  94.  
  95. # First make a backup (check that there is not already
  96. # one there first)
  97. if [ ! -f $INITDBAK ]
  98. then
  99. cp $INITD $INITDBAK
  100. fi
  101.  
  102. # Then use it to change it
  103. cat $INITDBAK |
  104. eval $AWKS > $INITD
  105.  
  106. # Now put the options in the /etc/default/bind file:
  107. cat >>$DEFAULT <<EOF
  108. # Make bind run with the user we defined
  109. OPTIONS="-u $USER -g $GROUP"
  110. EOF
  111.  
  112. echo "WARN: The script $INITD has been changed, trying to test the changes."
  113. echo "Restarting the named daemon (check for errors here)."
  114.  
  115. $INITD restart
  116. if [ $? -ne 0 ]
  117. then
  118. echo "ERR: Failed to restart the daemon."
  119. restore
  120. exit 1
  121. fi
  122.  
  123. RUNNING=`ps eo fname |grep named`
  124. if [ -z "$RUNNING" ]
  125. then
  126. echo "ERR: Named is not running, probably due to a problem with the changes."
  127. restore
  128. exit 1
  129. fi
  130.  
  131. # Check if it's running as expected
  132. RUNUSER=`ps eo user,fname |grep named |cut -f 1 -d " "`
  133.  
  134. if [ "$RUNUSER" = "$USER" ]
  135. then
  136. echo "All has gone well, named seems to be running now as $USER."
  137. else
  138. echo "ERR: The script failed to automatically change the system."
  139. echo "ERR: Named is currently running as $RUNUSER."
  140. restore
  141. exit 1
  142. fi
  143.  
  144. exit 0

The previous script, run on Woody’s (Debian 3.0) custom bind (version 8), will modify the initd file after creating the ‘named’ user and group and will


[78] Since version 9.2.1-5. That is, since Debian release sarge.