On the BIND 9.x server the IP address for hidden master authoritative name servers must not appear in the name servers set in the zone database.
An XCCDF Rule
Description
<VulnDiscussion>A hidden master authoritative server is an authoritative DNS server whose IP address does not appear in the name server set for a zone. All of the name servers that do appear in the zone database as designated name servers get their zone data from the hidden master via a zone transfer request. In effect, all visible name servers are actually secondary slave servers. This prevents potential attackers from targeting the master name server because its IP address may not appear in the zone database.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-207587r612253_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Edit the zone file(s).
Remove all references to the hidden master name server.
Restart the BIND 9.x process.