Jail Bind-9 in Linux

On Unix-like operating systems, such as Linux, a chroot jail is the common expression used to describe a section of a filesystem that is sectioned off for a particular user. On a web server, it is particularly useful for the security of shared hosting accounts.
Without a chroot jail, a user with limited file permissions would still be able to navigate to top-level directories. As an example, suppose the user’s directory is /home/user. Without chroot, nothing would prevent the user from navigating up to /home to see other users’ directories or even navigating up to / where they can see /etc, /usr, /var, /lib, and other system-critical directories. Although the user would not have the permissions to edit them, they would be able to see the files and target specific ones to try to exploit.

We can use following steps to jail bind in linux operating systems.

1:create a jail path
mkdir /named/jail

2:create following directories inside jail folder
mkdir -p /named/jail/etc
mkdir -p /named/jail/var 
mkdir -p /named/jail/dev

3:Create following files inside /named/jail/dev
mknod null c 1 3
mknod zero c 1 5
mknod random c 1 8

4:Edit the default file in etc of bind 9
gedit /etc/default/bind9

OPTIONS="-u bind -t /named/jail -c /named/jail/etc/bind/named.conf "

This file contain three parameters.
-t: jail path
-c: configuration file
-u: user


5:Cut /etc/bind folder and paste it inside /named/jail/etc
mv /etc/bind /named/jail/etc/bind

6:Create a symbolic link of file in /etc folder
ln -s /named/jail/etc/bind /etc/bind

7:Use following command to run bind in debugging mode.
named -g -d 9

8:Now use nslookup,dig to check whether bind9 is working properly or not.
nslookup 
>server host-ip-address {ipv4 adress of host that is running bind server}
>localhost          {domain name for which you want to find ipv4 address}

OR

dig @host-ip-address-of-bind-server doamin-name
example:dig @192.168.56.139 eva.localhost

/*Also change path used in named.conf and named.conf.local */