The Windows 2012 DNS Server must only allow the use of an approved DoD PKI-established certificate authorities for verification of the establishment of protected transactions.

An XCCDF Rule

Description

<VulnDiscussion>Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoD-approved CA, trust of this CA has not been established. The DoD will only accept PKI certificates obtained from a DoD-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of SSL/TLS certificates. TSIG and SIG(0) are not configurable in Windows 2012 DNS Server. To meet the requirement for authentication between Windows DNS servers, IPsec must be implemented between the Windows DNS servers. NOTE: If multiple certificates from the same CA are present on the DNS server, IPsec authentication might fail due to an incorrect certificate being chosen. For this purpose, an Active Directory Certificate Services (AD CS) role must be installed and configured as an Enterprise certification authority (CA). Refer to the U_Windows_Domain_Name_Service_2012_Overview.pdf for references on deploying certificates for this procedure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-215629r768716_rule
Severity: Medium
References: CCI-002470
Updated: about 1 year ago

Complete the following procedures twice for each pair of name servers.
 
First create a rule for UDP connections, and then create a rule for TCP connections.
 
Refer to the U_Windows_Domain_Name_Service_2012_Overview.pdf for Microsoft links for this procedure.
Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press Windows Key + R, execute gpme.msc to open the Group Policy Management feature.

In the Browse for Group Policy Object dialog box, double-click Domain Controllers.domain.com.

Click Default Domain Controllers Policy and click OK.

In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP.

Right-Click Connection Security Rules and select New.

For Rule Type, select the "Server-to-server" radio button, click Next.

For Endpoint 1 and Endpoint 2, select "These IP addresses:" and add the IP addresses of all DNS servers, click Next.

For Requirements, select "Request authentication for inbound and outbound connections", click Next.

For Authentication Method, select Computer certificate and from the "Signing Algorithm:" drop-down, select "RSA (default)".

From the "Certificate store type:" drop-down, select "Root CA (default).

From the "CA name:", click Browse and select the certificate generated by the internally-managed server performing the Active Directory Certificate Services (AD CS) role, click Next.

On Profile, accept default selections, click Next.

On Name, enter a name applicable to the rule's function (i.e., DNSSEC UDP), click Finish.

The Windows 2012 DNS Server must only allow the use of an approved DoD PKI-established certificate authorities for verification of the establishment of protected transactions.

Description

Remediation - Manual Procedure