Subject: Re: tightening control on socket bind()ing
To: None <tech-security@netbsd.org>
From: Simon J. Gerraty <sjg@quick.com.au>
List: tech-security
Date: 03/10/1999 15:09:43
>4. use the solution that FreeBSD use (derived from the OpenBSD
> solution): prevent a bind if another socket on the same port is
> bound, irregardless of whether SO_REUSE{ADDR,PORT} is set, if
> the following is not true:
> * the new bind() is being done by euid==0, or
> * the new bind() is of a different euid to the existing socket
>after discussion with a few other people, it appears that `4.' is
>probably the sanest/easiest solution; it requires no code modification
>of existing daemons, and shouldn't affect.
The wording of 4. above is a little confusing. Suffice to say, if
I can still hack inetd to bind to a one or more explicit addresses
so that I can run multiple inetds with different config, then it sounds
good. Ie. for a long time (before ipfilter was integrated :-) I ran
a minimal config inetd bound to by ppp address only, and a more
complete inetd bound to loopback and ethernet addresses.
--sjg