Using DJBDNS and Getting Out of a BIND

by Brian Hatch

July 15, 2002 —

For the next few weeks, I'm going to show you how to install DJBDNS, the
DNS server software written by Dan Bernstein (henceforth simply 'DJB').
It has a very different approach to serving and caching DNS answers than
BIND, the ISC's DNS daemon. If you compare DJBDNS' number of
vulnerabilities over its lifetime (0) with that of BIND (too many for me
to count) plus the ease of DNS data management (all entries are in one
file, each on their own independent line, editable by programs and
humans alike), you may find a switch to DJBDNS is both good for your
security and good for your sanity.

I'll be installing all the software to DJB's standard directory
locations. These are not your traditional /usr/local/bin and friends, so
I'll try to summarize where things end up at the end of each of these
articles.

Installing Daemontools
Most software meant to run continuously, such as Apache or OpenSSH, is
written as a true daemon process. It is started on bootup from the
/etc/rc?.d scripts, dissociates from it's TTY, closes off file
descriptors like STDIN, cd's to /, and runs in the background.
Generally, you can start or stop the daemon simply by calling the
appropriate /etc/init.d/WHATEVER script with 'start' or 'stop' options.

The problem with this method is that any process that dies unexpectantly
isn't automatically restarted. If Apache dies, it's dead until you log
in and restart it. DJB decided instead to create his own inetd-style
system to start daemon processes and automatically respawn them when
they exit. The programs necessary to perform this are part of his
daemontools package, so we need to install these helper programs first.

# umask 022
# mkdir /package
# chmod 1755 /package
# cd /package
# wget http://cr.yp.to/daemontools/daemontools-0.76.tar.gz
# tar xzvf daemontools-0.76.tar.gz
# rm daemontools-0.76.tar.gz
# cd admin/daemontools-0.76
# package/install

Your computer will crunch for a while as it compiles and installs the
daemontools software, which includes 18 different programs -- each of
which performs a very minimal and specific function. The setuidgid
program, for example, is used (by root) to start a new process as a new
userid. Typically these programs are used together, each process
exec'ing a new one. The first may change userids, the next will add
environment variables, the next will enforce some kernel process limits,
and so on.

The executables are stored in /packages/admin/daemontools/command, and
symbolic links are created to these in both the /command directory and
/usr/local/bin, for convienience.

Svscan is the program that will handle starting our DJBDNS processes.
Svscan is started from init - the very first process run by the computer
on bootup. Init itself makes sure that, should svscan stop, it is
restarted again. For this reason, the daemontools installation adds a
new entry to the /etc/inittab and sends init a HUP to re-read this file.
The new entry looks like this:

SV:123456:respawn:/command/svscanboot

Svscan's job is to start the 'supervise' program any time a new
directory is created inside the /service directory, such as
/service/tinydns. Supervise then executes the program
/service/tinydns/run restarting it any time the process exits. So to
summarize, 'supervise' is charged with running a particular service,
'svscan' is charged with making sure all those supervise process run,
and init makes sure svscan is running. If init dies, well, your computer
is going down really fast anyway.

So now we've installed the daemontools package that'll be keeping our
DJBDNS process alive. Files we played with today:

/package/admin -- A directory where various DJB software will be
installed. Today we installed /package/admin/daemontools-0.76, along
with a link to that directory named /package/admin/daemontools.

The fact that the symbolic name 'daemontools' is a link means that
you can have multiple versions of daemontools installed while you
test things out.

/service -- The directory that will point to daemons that need to be
started, currently empty.

/command -- A directory where symlinks to the executables will
reside. For example, the symlink /command/envdir points to
/package/admin/daemontools/command/envdir. (And this is actually a
link pointing to the daemontools-0.76 version.)

/etc/inittab -- The install added a line to /etc/inittab to start
svscan.

You can use the daemontools programs for more than just DJBDNS and
related software. You can easily create daemons from software as simple
as shell scripts using daemontools' /service functionality, for example.

Next week: Installing DJBDNS itself.

ITworld