Skip to content
ATO Pathways
  Log In

BIND 9.x Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-APP-000247-DNS-000036

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-APP-000231-DNS-000033

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-APP-000243-DNS-000034

    <GroupDescription></GroupDescription>
    Group
    Show

  • A BIND 9.x server implementation must be running in a chroot(ed) directory structure.

    &lt;VulnDiscussion&gt;With any network service, there is the potential that an attacker can exploit a vulnerability within the program that allows ...
    Rule Low Severity
    Show

  • SRG-APP-000516-DNS-000097

    <GroupDescription></GroupDescription>
    Group
    Show

  • A BIND 9.x server implementation must be operating on a Current-Stable version as defined by ISC.

    &lt;VulnDiscussion&gt;The BIND STIG was written to incorporate capabilities and features provided in BIND version 9.9.x. However, it is recognized ...
    Rule High Severity
    Show

  • SRG-APP-000516-DNS-000109

    <GroupDescription></GroupDescription>
    Group
    Show

  • The platform on which the name server software is hosted must only run processes and services needed to support the BIND 9.x implementation.

    &lt;VulnDiscussion&gt;Hosts that run the name server software should not provide any other services. Unnecessary services running on the DNS server...
    Rule Medium Severity
    Show

  • SRG-APP-000516-DNS-000105

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-APP-000089-DNS-000005

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server software must run with restricted privileges.

    &lt;VulnDiscussion&gt;Failure to provide logical access restrictions associated with changes to application configuration may have significant effe...
    Rule Medium Severity
    Show

  • SRG-APP-000516-DNS-000109

    <GroupDescription></GroupDescription>
    Group
    Show

  • The host running a BIND 9.X implementation must implement a set of firewall rules that restrict traffic on the DNS interface.

    &lt;VulnDiscussion&gt;Configuring hosts that run a BIND 9.X implementation to only accept DNS traffic on a DNS interface allows a system firewall t...
    Rule Medium Severity
    Show

  • SRG-APP-000516-DNS-000109

    <GroupDescription></GroupDescription>
    Group
    Show

  • The host running a BIND 9.x implementation must use a dedicated management interface in order to separate management traffic from DNS specific traffic.

    &lt;VulnDiscussion&gt;Providing Out-Of-Band (OOB) management is the best first step in any management strategy. No production traffic resides on an...
    Rule Medium Severity
    Show

  • SRG-APP-000516-DNS-000109

    <GroupDescription></GroupDescription>
    Group
    Show

  • The host running a BIND 9.x implementation must use an interface that is configured to process only DNS traffic.

    &lt;VulnDiscussion&gt;Configuring hosts that run a BIND 9.X implementation to only accept DNS traffic on a DNS interface allows a system to be conf...
    Rule Medium Severity
    Show

  • SRG-APP-000089-DNS-000004

    <GroupDescription></GroupDescription>
    Group
    Show

  • A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components, based on selectable event criteria, and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes.

    &lt;VulnDiscussion&gt;Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events r...
    Rule Low Severity
    Show

  • SRG-APP-000125-DNS-000012

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server implementation must not be configured with a channel to send audit records to null.

    &lt;VulnDiscussion&gt;DNS software administrators require DNS transaction logs for a wide variety of reasons including troubleshooting, intrusion d...
    Rule Low Severity
    Show

  • SRG-APP-000001-DNS-000115

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server logging configuration must be configured to generate audit records for all DoD-defined auditable events to a local file by enabling triggers for all events with a severity of info, notice, warning, error, and critical for all DNS components.

    &lt;VulnDiscussion&gt;Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events r...
    Rule Low Severity
    Show

  • SRG-APP-000350-DNS-000044

    <GroupDescription></GroupDescription>
    Group
    Show

  • In the event of an error when validating the binding of other DNS servers identity to the BIND 9.x information, when anomalies in the operation of the signed zone transfers are discovered, for the success and failure of start and stop of the name server service or daemon, and for the success and failure of all name server events, a BIND 9.x server implementation must generate a log entry.

    &lt;VulnDiscussion&gt;Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is ...
    Rule Low Severity
    Show

  • SRG-APP-000095-DNS-000006

    <GroupDescription></GroupDescription>
    Group
    Show

  • The print-severity variable for the configuration of BIND 9.x server logs must be configured to produce audit records containing information to establish what type of events occurred.

    &lt;VulnDiscussion&gt;Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is ...
    Rule Low Severity
    Show

  • SRG-APP-000096-DNS-000007

    <GroupDescription></GroupDescription>
    Group
    Show

  • The print-time variable for the configuration of BIND 9.x server logs must be configured to establish when (date and time) the events occurred.

    &lt;VulnDiscussion&gt;Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events relating to a...
    Rule Low Severity
    Show

  • SRG-APP-000097-DNS-000008

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server implementation must limit the number of concurrent session client connections to the number of allowed dynamic update clients.

    &lt;VulnDiscussion&gt;Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name serv...
    Rule Medium Severity
    Show

  • SRG-APP-000142-DNS-000014

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server implementation must be configured to use only approved ports and protocols.

    &lt;VulnDiscussion&gt;In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e....
    Rule Medium Severity
    Show

  • The print-category variable for the configuration of BIND 9.x server logs must be configured to record information indicating which process generated the events.

    &lt;VulnDiscussion&gt;Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events relating to ...
    Rule Low Severity
    Show

  • SRG-APP-000125-DNS-000012

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server implementation must be configured with a channel to send audit records to a remote syslog.

    &lt;VulnDiscussion&gt;Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to a differen...
    Rule Low Severity
    Show

  • SRG-APP-000125-DNS-000012

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server implementation must be configured with a channel to send audit records to a local file.

    &lt;VulnDiscussion&gt;DNS software administrators require DNS transaction logs for a wide variety of reasons including troubleshooting, intrusion d...
    Rule Low Severity
    Show

  • SRG-APP-000125-DNS-000012

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x server implementation must maintain at least 3 file versions of the local log file.

    &lt;VulnDiscussion&gt;DNS software administrators require DNS transaction logs for a wide variety of reasons including troubleshooting, intrusion d...
    Rule Low Severity
    Show

  • SRG-APP-000001-DNS-000001

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x secondary name server must limit the number of zones requested from a single master name server.

    &lt;VulnDiscussion&gt;Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name serve...
    Rule Medium Severity
    Show

  • SRG-APP-000001-DNS-000001

    <GroupDescription></GroupDescription>
    Group
    Show

  • The BIND 9.x secondary name server must limit the total number of zones the name server can request at any one time.

    &lt;VulnDiscussion&gt;Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name serve...
    Rule Medium Severity
    Show

  • A BIND 9.x server implementation must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks.

    &lt;VulnDiscussion&gt;A DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot ...
    Rule Medium Severity
    Show

  • SRG-APP-000246-DNS-000035

    <GroupDescription></GroupDescription>
    Group
    Show

  • A BIND 9.x server implementation must prohibit recursion on authoritative name servers.

    &lt;VulnDiscussion&gt;A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the ...
    Rule Medium Severity
    Show

  • SRG-APP-000516-DNS-000088

    <GroupDescription></GroupDescription>
    Group
    Show

  • The master servers in a BIND 9.x implementation must notify authorized secondary name servers when zone files are updated.

    &lt;VulnDiscussion&gt;It is important to maintain the integrity of a zone file. The serial number of the SOA record is used to indicate to secondar...
    Rule Low Severity
    Show

  • SRG-APP-000516-DNS-000088

    <GroupDescription></GroupDescription>
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules