Skip to content
ATO Pathways
  Log In

BIND 9.x Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • On the BIND 9.x server the platform on which the name server software is hosted must be configured to send outgoing DNS messages from a random port.

    <VulnDiscussion>Hosts that run the name server software should not provide any other services and therefore should be configured to respond t...
    Rule Low Severity
    Show

  • SRG-APP-000447-DNS-000068

    <GroupDescription></GroupDescription>
    Group
    Show

  • The TSIG keys used with the BIND 9.x implementation must be group owned by a privileged account.

    &lt;VulnDiscussion&gt;Incorrect ownership of a TSIG key file could allow an adversary to modify the file, thus defeating the security objective.&lt...
    Rule Medium Severity
    Show

  • SRG-APP-000176-DNS-000019

    <GroupDescription></GroupDescription>
    Group
    Show

  • The read and write access to a TSIG key file used by a BIND 9.x server must be restricted to only the account that runs the name server software.

    &lt;VulnDiscussion&gt;Weak permissions of a TSIG key file could allow an adversary to modify the file, thus defeating the security objective.&lt;/V...
    Rule Medium Severity
    Show

  • SRG-APP-000516-DNS-000500

    <GroupDescription></GroupDescription>
    Group
    Show

  • A BIND 9.x caching name server must implement DNSSEC validation to check all DNS queries for invalid input.

    &lt;VulnDiscussion&gt;A common vulnerability of applications is unpredictable behavior when invalid inputs are received. This requirement guards ag...
    Rule Medium Severity
    Show

  • SRG-APP-000001-DNS-000001

    <GroupDescription></GroupDescription>
    Group
    Show

  • A BIND 9.x master name server must limit the number of concurrent zone transfers between authorized secondary name servers.

    &lt;VulnDiscussion&gt;Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name serve...
    Rule Medium Severity
    Show

  • SRG-APP-000246-DNS-000035

    <GroupDescription></GroupDescription>
    Group
    Show

  • A BIND 9.x implementation configured as a caching name server must restrict recursive queries to only the IP addresses and IP address ranges of known supported clients.

    &lt;VulnDiscussion&gt;Any host that can query a resolving name server has the potential to poison the servers name cache or take advantage of other...
    Rule Medium Severity
    Show

  • SRG-APP-000158-DNS-000015

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server implementation must uniquely identify and authenticate the other DNS server before responding to a server-to-server transaction, zone transfer and/or dynamic update request using cryptographically based bidirectional authentication to protect the integrity of the information in transit.

    &lt;VulnDiscussion&gt;Server-to-server (zone transfer) transactions are provided by TSIG, which enforces mutual server authentication using a key t...
    Rule High Severity
    Show

  • SRG-APP-000158-DNS-000015

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server implementation must utilize separate TSIG key-pairs when securing server-to-server transactions.

    &lt;VulnDiscussion&gt;Server-to-server (zone transfer) transactions are provided by TSIG, which enforces mutual server authentication using a key t...
    Rule Medium Severity
    Show

  • SRG-APP-000176-DNS-000018

    <GroupDescription></GroupDescription>
    Group
    Show

  • The TSIG keys used with the BIND 9.x implementation must be owned by a privileged account.

    &lt;VulnDiscussion&gt;Incorrect ownership of a TSIG key file could allow an adversary to modify the file, thus defeating the security objective.&lt...
    Rule Medium Severity
    Show

  • SRG-APP-000176-DNS-000018

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-APP-000243-DNS-000034

    <GroupDescription></GroupDescription>
    Group
    Show

  • A BIND 9.x server implementation must be running in a chroot(ed) directory structure.

    &lt;VulnDiscussion&gt;With any network service, there is the potential that an attacker can exploit a vulnerability within the program that allows ...
    Rule Low Severity
    Show

  • SRG-APP-000516-DNS-000097

    <GroupDescription></GroupDescription>
    Group
    Show

  • A BIND 9.x server implementation must be operating on a Current-Stable version as defined by ISC.

    &lt;VulnDiscussion&gt;The BIND STIG was written to incorporate capabilities and features provided in BIND version 9.9.x. However, it is recognized ...
    Rule High Severity
    Show

  • SRG-APP-000516-DNS-000109

    <GroupDescription></GroupDescription>
    Group
    Show

  • The platform on which the name server software is hosted must only run processes and services needed to support the BIND 9.x implementation.

    &lt;VulnDiscussion&gt;Hosts that run the name server software should not provide any other services. Unnecessary services running on the DNS server...
    Rule Medium Severity
    Show

  • SRG-APP-000516-DNS-000105

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server software must run with restricted privileges.

    &lt;VulnDiscussion&gt;Failure to provide logical access restrictions associated with changes to application configuration may have significant effe...
    Rule Medium Severity
    Show

  • SRG-APP-000516-DNS-000109

    <GroupDescription></GroupDescription>
    Group
    Show

  • The host running a BIND 9.X implementation must implement a set of firewall rules that restrict traffic on the DNS interface.

    &lt;VulnDiscussion&gt;Configuring hosts that run a BIND 9.X implementation to only accept DNS traffic on a DNS interface allows a system firewall t...
    Rule Medium Severity
    Show

  • SRG-APP-000516-DNS-000109

    <GroupDescription></GroupDescription>
    Group
    Show

  • The host running a BIND 9.x implementation must use a dedicated management interface in order to separate management traffic from DNS specific traffic.

    &lt;VulnDiscussion&gt;Providing Out-Of-Band (OOB) management is the best first step in any management strategy. No production traffic resides on an...
    Rule Medium Severity
    Show

  • SRG-APP-000516-DNS-000109

    <GroupDescription></GroupDescription>
    Group
    Show

  • The host running a BIND 9.x implementation must use an interface that is configured to process only DNS traffic.

    &lt;VulnDiscussion&gt;Configuring hosts that run a BIND 9.X implementation to only accept DNS traffic on a DNS interface allows a system to be conf...
    Rule Medium Severity
    Show

  • SRG-APP-000089-DNS-000004

    <GroupDescription></GroupDescription>
    Group
    Show

  • A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components, based on selectable event criteria, and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes.

    &lt;VulnDiscussion&gt;Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events r...
    Rule Low Severity
    Show

  • SRG-APP-000125-DNS-000012

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server implementation must not be configured with a channel to send audit records to null.

    &lt;VulnDiscussion&gt;DNS software administrators require DNS transaction logs for a wide variety of reasons including troubleshooting, intrusion d...
    Rule Low Severity
    Show

  • SRG-APP-000089-DNS-000005

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server logging configuration must be configured to generate audit records for all DoD-defined auditable events to a local file by enabling triggers for all events with a severity of info, notice, warning, error, and critical for all DNS components.

    &lt;VulnDiscussion&gt;Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events r...
    Rule Low Severity
    Show

  • SRG-APP-000350-DNS-000044

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server implementation must be configured with a channel to send audit records to a local file.

    &lt;VulnDiscussion&gt;DNS software administrators require DNS transaction logs for a wide variety of reasons including troubleshooting, intrusion d...
    Rule Low Severity
    Show

  • SRG-APP-000125-DNS-000012

    <GroupDescription></GroupDescription>
    Group
    Show

  • In the event of an error when validating the binding of other DNS servers identity to the BIND 9.x information, when anomalies in the operation of the signed zone transfers are discovered, for the success and failure of start and stop of the name server service or daemon, and for the success and failure of all name server events, a BIND 9.x server implementation must generate a log entry.

    &lt;VulnDiscussion&gt;Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is ...
    Rule Low Severity
    Show

  • SRG-APP-000095-DNS-000006

    <GroupDescription></GroupDescription>
    Group
    Show

  • The print-severity variable for the configuration of BIND 9.x server logs must be configured to produce audit records containing information to establish what type of events occurred.

    &lt;VulnDiscussion&gt;Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is ...
    Rule Low Severity
    Show

  • SRG-APP-000096-DNS-000007

    <GroupDescription></GroupDescription>
    Group
    Show

  • The print-time variable for the configuration of BIND 9.x server logs must be configured to establish when (date and time) the events occurred.

    &lt;VulnDiscussion&gt;Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events relating to a...
    Rule Low Severity
    Show

  • SRG-APP-000097-DNS-000008

    <GroupDescription></GroupDescription>
    Group
    Show

  • The print-category variable for the configuration of BIND 9.x server logs must be configured to record information indicating which process generated the events.

    &lt;VulnDiscussion&gt;Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events relating to ...
    Rule Low Severity
    Show

  • SRG-APP-000125-DNS-000012

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server implementation must be configured with a channel to send audit records to a remote syslog.

    &lt;VulnDiscussion&gt;Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to a differen...
    Rule Low Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules