Do Not Use Dynamic DNS
An XCCDF Rule
Description
To prevent the DHCP server from receiving DNS information from
clients, edit /etc/dhcp/dhcpd.conf, and add or correct the following global
option:
ddns-update-style none;
warning alert: Warning
The ddns-update-style option controls only whether
the DHCP server will attempt to act as a Dynamic DNS client. As long as the DNS
server itself is correctly configured to reject DDNS attempts, an incorrect
ddns-update-style setting on the client is harmless (but should be fixed as a
best practice).
Rationale
The Dynamic DNS protocol is used to remotely update the data served by a DNS server. DHCP servers can use Dynamic DNS to publish information about their clients. This setup carries security risks, and its use is not recommended. If Dynamic DNS must be used despite the risks it poses, it is critical that Dynamic DNS transactions be protected using TSIG or some other cryptographic authentication mechanism. See dhcpd.conf(5) for more information about protecting the DHCP server from passing along malicious DNS data from its clients.
- ID
- xccdf_org.ssgproject.content_rule_dhcp_server_disable_ddns
- Severity
- Unknown
- References
- Updated