lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 02 Nov 2007 11:45:53 +0100
From: Shane Kerr <Shane_Kerr@....org>
To: Tim <tim-security@...tinelchicken.org>
Cc: bugtraq@...urityfocus.com
Subject: Re: Comments re ISC's announcement on bind9 security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tim,

> On another note, why is it that everyone arguing the all-or-nothing case
> likes to ignore the other very-usable-now mitigation of randomizing
> source ports?  I don't use BIND and I don't care to check it's current
> behavior, but has the ISC finally gotten around to randomizing the
> source ports?  If not, why not?  The extra few bits of entropy can go a
> long way, particularly if a good PRNG is used.

Yes, ISC has finally gotten around to randomizing the source ports, as of
9.5.0a2. It is controlled by the "use-queryport-pool" option in the server
section of the BIND configuration file. It defaults to "yes".

You can control how big the pool is with the "queryport-pool-ports" option. It
defaults to 8 (an extra 3 bits of entropy).

This set of ports is refreshed periodically, with a frequency controlled by the
"queryport-pool-updateinterval" option. (Personally I think this option adds no
little value from a security point of view, but it doesn't hurt.)

- --
Shane
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHKv/gMsfZxBO4kbQRAq0KAJ4h0r4x1GMsucrfkRxptywSCzONxwCfc4U/
gRtVT40M1wud2wlviLwoQ9c=
=EQk/
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists