Скачать или смотреть Securing BIND 9 with AppArmor/Firejail/SecompBPF, 20 October 2021

This webinar looks at alternatives to SELinux to securing BIND 9 application servers. Trainer Carsten Strotmann walks you through the critical commands needed to enable, disable and view restrictions that can protect your server from overuse or intrusions coming from the BIND 9 process. Measures like this can protect against unknown future vulnerabilities, as well as protect the named process itself. Topics discussed include:

AppArmor on Ubuntu/Debian
Securing a BIND 9 Server with “Firejail”
Introduction to Secomp/BPF “syscall Firewall”
Restricting Syscalls with Secomp and systemd
Hardening a BIND 9 installation with Systemd

In addition Carsten shared his Systemd 'unit' file here: https://webinar.defaultroutes.de/webi...

and a Firejail profile template here:
https://webinar.defaultroutes.de/webi...

(The slides are available at: https://www.isc.org/docs/2021-10-webi...)

You are welcome to post your questions about BIND 9 DNS on our helpful community mailing list at https://lists.isc.org/mailman/listinf.... The BIND Administrative Reference Manual is online at https://bind9.readthedocs.io/en/stable/. We also maintain a knowledgebase of handy technical articles at https://kb.isc.org.

Internet Systems Consortium maintains and publishes the BIND 9 DNS software under the open source MPL 2.0 license. ISC is a non-profit, operating to help support the Internet infrastructure and facilitate independent connection to and participation in the Internet. We support this work by offering users professional technical support contracts, including advance notification of security vulnerabilities before public disclosure.
---
Learn more at https://www.isc.org