Summary: DJBDNS eases DNS management and improves security over BIND alternatives by taking a different approach to serving and caching DNS answers.

For the next few weeks, I'm going to show you how to install DJBDNS, the DNS server software written by Dan Bernstein (henceforth simply 'DJB'). It has a very different approach to serving and caching DNS answers than BIND, the ISC's DNS daemon. If you compare DJBDNS' number of vulnerabilities over its lifetime (0) with that of BIND (too many for me to count) plus the ease of DNS data management (all entries are in one file, each on their own independent line, editable by programs and humans alike), you may find a switch to DJBDNS is both good for your security and good for your sanity.

I'll be installing all the software to DJB's standard directory locations. These are not your traditional /usr/local/bin and friends, so I'll try to summarize where things end up at the end of each of these articles.

Installing Daemontools Most software meant to run continuously, such as Apache or OpenSSH, is written as a true daemon process. It is started on bootup from the /etc/rc?.d scripts, dissociates from it's TTY, closes off file descriptors like STDIN, cd's to /, and runs in the background. Generally, you can start or stop the daemon simply by calling the appropriate /etc/init.d/WHATEVER script with 'start' or 'stop' options.

The problem with this method is that any process that dies unexpectantly isn't automatically restarted. If Apache dies, it's dead until you log in and restart it. DJB decided instead to create his own inetd-style system to start daemon processes and automatically respawn them when they exit. The programs necessary to perform this are part of his daemontools package, so we need to install these helper programs first.

# umask 022
# mkdir /package
# chmod 1755 /package
# cd /package
# wget http://cr.yp.to/daemontools/daemontools-0.76.tar.gz
# tar xzvf daemontools-0.76.tar.gz
# rm daemontools-0.76.tar.gz
# cd admin/daemontools-0.76
# package/install

Your computer will crunch for a while as it compiles and installs the daemontools software, which includes 18 different programs -- each of which performs a very minimal and specific function. The setuidgid program, for example, is used (by root) to start a new process as a new userid. Typically these programs are used together, each process exec'ing a new one. The first may change userids, the next will add environment variables, the next will enforce some kernel process limits, and so on.

The executables are stored in /packages/admin/daemontools/command, and symbolic links are created to these in both the /command directory and /usr/local/bin, for convienience.

Svscan is the program that will handle starting our DJBDNS processes. Svscan is started from init - the very first process run by the computer on bootup. Init itself makes sure that, should svscan stop, it is restarted again. For this reason, the daemontools installation adds a new entry to the /etc/inittab and sends init a HUP to re-read this file. The new entry looks like this:

SV:123456:respawn:/command/svscanboot

Svscan's job is to start the 'supervise' program any time a new directory is created inside the /service directory, such as /service/tinydns. Supervise then executes the program /service/tinydns/run restarting it any time the process exits. So to summarize, 'supervise' is charged with running a particular service, 'svscan' is charged with making sure all those supervise process run, and init makes sure svscan is running. If init dies, well, your computer is going down really fast anyway.

So now we've installed the daemontools package that'll be keeping our DJBDNS process alive. Files we played with today:

/package/admin -- A directory where various DJB software will be installed. Today we installed /package/admin/daemontools-0.76, along with a link to that directory named /package/admin/daemontools.

The fact that the symbolic name 'daemontools' is a link means that you can have multiple versions of daemontools installed while you test things out.

/service -- The directory that will point to daemons that need to be started, currently empty.

/command -- A directory where symlinks to the executables will reside. For example, the symlink /command/envdir points to /package/admin/daemontools/command/envdir. (And this is actually a link pointing to the daemontools-0.76 version.)

/etc/inittab -- The install added a line to /etc/inittab to start svscan.

You can use the daemontools programs for more than just DJBDNS and related software. You can easily create daemons from software as simple as shell scripts using daemontools' /service functionality, for example.

Next week: Installing DJBDNS itself.

Bri Hatch is Chief Hacker at Onsight, Inc, and author of Hacking Linux Exposed and Building Linux VPNs. He's been administering DNS servers for long enough that he knows a good BIND replacement when he sees one. Of course *any* replacement is a good start. Bri can be reached at bri@hackinglinuxexposed.com.

Copyright Bri Hatch, 2002.

This article was first published here in ITworld.com Inc., 118 Turnpike Rd., Southborough, MA 01772  on 16-Jul-2002.