This script automates the procedure for changing the bind version 8 name server's default installation so that it does not run as the superuser. Notice that bind version 9 in Debian already does this by default ^[76] , and you are much better using that version than bind version 8.

This script is here for historical purposes and to show how you can automate this kind of changes system-wide. The script will create the user and groups defined for the name server and will modify both /etc/default/bind and /etc/init.d/bind so that the program will run with that user. Use with extreme care since it has not been tested thoroughly.

You can also create the users manually and use the patch available for the default init.d script attached to http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=157245.

  #!/bin/sh
  # Change the default Debian bind configuration to have it run
  # with a non-root user and group.
  #
  # WARN: This script has not been tested thoroughly, please
  # verify the changes made to the INITD script

  # (c) 2002 Javier Fernandez-Sanguino Peña
  #
  #    This program is free software; you can redistribute it and/or modify
  #    it under the terms of the GNU General Public License as published by
  #    the Free Software Foundation; either version 1, or (at your option)
  #    any later version.
  #
  #    This program is distributed in the hope that it will be useful,
  #    but WITHOUT ANY WARRANTY; without even the implied warranty of
  #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  #    GNU General Public License for more details.
  #
  #     Please see the file `COPYING' for the complete copyright notice.
  #

  restore() {
  # Just in case, restore the system if the changes fail
\t  echo "WARN: Restoring to the previous setup since I'm unable to properly change it."
\t  echo "WARN: Please check the $INITDERR script."
\t  mv $INITD $INITDERR
\t  cp $INITDBAK $INITD
  }


  USER=named
  GROUP=named
  INITD=/etc/init.d/bind
  INITDBAK=$INITD.preuserchange
  INITDERR=$INITD.changeerror
  START="start-stop-daemon --start --quiet --exec /usr/sbin/named -- -g $GROUP -u $USER"
  AWKS="awk ' /start-stop-daemon --start/ { print \"$START\"; noprint = 1; }; /\/usr\/sbin\/ndc reload/ { print \"stop; sleep 2; start;\"; noprint = 1; } /\\\\$/ { if ( noprint != 0 ) { noprint = noprint + 1;} } /^.*$/ { if ( noprint != 0 ) { noprint = noprint - 1; } else { print \$0; } } '"

  [ `id -u` -ne 0 ] && {
\t  echo "This program must be run by the root user"
\t  exit 1
  }

  RUNUSER=`ps -eo user,fname |grep named |cut -f 1 -d " "`

  if [ "$RUNUSER" = "$USER" ] 
  then
\t  echo "WARN: The name server running daemon is already running as $USER"
\t  echo "ERR:  This script will not many any changes to your setup."
\t  exit 1
  fi
  if [ ! -f $INITD ]
  then
\t  echo "ERR:  This system does not have $INITD (which this script tries to change)"
\t  RUNNING=`ps -eo fname |grep named`
\t   [ -z "$RUNNING" ] && \
\t      echo "ERR:  In fact the name server daemon is not even running (is it installed?)"
\t   echo "ERR:  No changes will be made to your system"
\t  exit 1
  fi

  # Check if named group exists
  if [ -z "`grep $GROUP /etc/group`" ] 
  then
\t  echo "Creating group $GROUP:"
\t  addgroup $GROUP
  else
\t  echo "WARN: Group $GROUP already exists. Will not create it"
  fi
  # Same for the user
  if [ -z "`grep $USER /etc/passwd`" ] 
  then
\t  echo "Creating user $USER:"
\t  adduser --system --home /home/$USER \
\t  --no-create-home --ingroup $GROUP \
\t  --disabled-password --disabled-login $USER
  else
\t  echo "WARN: The user $USER already exists. Will not create it"
  fi

  # Change the init.d script

  # First make a backup (check that there is not already
  # one there first)
  if [ ! -f $INITDBAK ] 
  then
\t  cp $INITD $INITDBAK
  fi

  # Then use it to change it
  cat $INITDBAK |
  eval $AWKS > $INITD

  echo "WARN: The script $INITD has been changed, trying to test the changes."
  echo "Restarting the named daemon (check for errors here)."

  $INITD restart
  if [ $? -ne 0 ] 
  then
\t  echo "ERR:  Failed to restart the daemon."
\t  restore
\t  exit 1
  fi

  RUNNING=`ps -eo fname |grep named`
  if [ -z "$RUNNING" ] 
  then
\t  echo "ERR:  Named is not running, probably due to a problem with the changes."
\t  restore
\t  exit 1
  fi

  # Check if it's running as expected
  RUNUSER=`ps -eo user,fname |grep named |cut -f 1 -d " "`

  if [ "$RUNUSER" = "$USER" ] 
  then
\t  echo "All has gone well, named seems to be running now as $USER."
  else
\t  echo "ERR:  The script failed to automatically change the system."
\t  echo "ERR:  Named is currently running as $RUNUSER."
\t  restore
\t  exit 1
  fi

  exit 0

O script anterior, execute-o no bind customizado do Woody (Debian 3.0), irá produzir o arquivo initd abaixo depois de criar o usuário e grupo 'named':