III - Administrative Public
Rules and Groups employed by this XCCDF Profile
-
SRG-APP-000243-DNS-000034
Group -
A BIND 9.x server implementation must be running in a chroot(ed) directory structure.
With any network service, there is the potential that an attacker can exploit a vulnerability within the program that allows the attacker to gain control of the process and even run system commands...Rule Low Severity -
SRG-APP-000516-DNS-000097
Group -
A BIND 9.x server implementation must be operating on a Current-Stable version as defined by ISC.
The BIND STIG was written to incorporate capabilities and features provided in BIND version 9.9.x. However, it is recognized that security vulnerabilities in BIND are identified and then addressed ...Rule High Severity -
SRG-APP-000516-DNS-000109
Group -
The platform on which the name server software is hosted must only run processes and services needed to support the BIND 9.x implementation.
Hosts that run the name server software should not provide any other services. Unnecessary services running on the DNS server can introduce additional attack vectors leading to the compromise of an...Rule Medium Severity -
SRG-APP-000516-DNS-000105
Group -
The BIND 9.x server software must run with restricted privileges.
Failure to provide logical access restrictions associated with changes to application configuration may have significant effects on the overall security of the system. When dealing with access rest...Rule Medium Severity -
SRG-APP-000516-DNS-000109
Group -
The host running a BIND 9.X implementation must implement a set of firewall rules that restrict traffic on the DNS interface.
Configuring hosts that run a BIND 9.X implementation to only accept DNS traffic on a DNS interface allows a system firewall to be configured to limit the allowed incoming ports/protocols to 53/tcp ...Rule Medium Severity -
SRG-APP-000516-DNS-000109
Group -
The host running a BIND 9.x implementation must use a dedicated management interface in order to separate management traffic from DNS specific traffic.
Providing Out-Of-Band (OOB) management is the best first step in any management strategy. No production traffic resides on an out-of-band network. The biggest advantage to implementation of an OOB ...Rule Medium Severity -
SRG-APP-000516-DNS-000109
Group -
The host running a BIND 9.x implementation must use an interface that is configured to process only DNS traffic.
Configuring hosts that run a BIND 9.X implementation to only accept DNS traffic on a DNS interface allows a system to be configured to segregate DNS traffic from all other host traffic. The TCP/IP...Rule Medium Severity -
SRG-APP-000089-DNS-000004
Group -
A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components, based on selectable event criteria, and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes.
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. The actua...Rule Low Severity -
SRG-APP-000125-DNS-000012
Group -
The BIND 9.x server implementation must not be configured with a channel to send audit records to null.
DNS software administrators require DNS transaction logs for a wide variety of reasons including troubleshooting, intrusion detection, and forensics. Ensuring that the DNS transaction logs are reco...Rule Low Severity -
SRG-APP-000089-DNS-000005
Group -
The BIND 9.x server logging configuration must be configured to generate audit records for all DoD-defined auditable events to a local file by enabling triggers for all events with a severity of info, notice, warning, error, and critical for all DNS components.
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. The actua...Rule Low Severity -
SRG-APP-000350-DNS-000044
Group -
In the event of an error when validating the binding of other DNS servers identity to the BIND 9.x information, when anomalies in the operation of the signed zone transfers are discovered, for the success and failure of start and stop of the name server service or daemon, and for the success and failure of all name server events, a BIND 9.x server implementation must generate a log entry.
Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being performed on the system, where an event occurred, when an event oc...Rule Low Severity -
SRG-APP-000095-DNS-000006
Group -
The print-severity variable for the configuration of BIND 9.x server logs must be configured to produce audit records containing information to establish what type of events occurred.
Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being performed on the system, where an event occurred, when an event oc...Rule Low Severity -
SRG-APP-000096-DNS-000007
Group -
The print-time variable for the configuration of BIND 9.x server logs must be configured to establish when (date and time) the events occurred.
Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events relating to an incident. Associating event types with detected events in the applic...Rule Low Severity -
SRG-APP-000097-DNS-000008
Group -
The print-category variable for the configuration of BIND 9.x server logs must be configured to record information indicating which process generated the events.
Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events relating to an incident. Associating information about where the event occurred with...Rule Low Severity -
SRG-APP-000125-DNS-000012
Group -
The BIND 9.x server implementation must be configured with a channel to send audit records to a remote syslog.
Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to a different system or onto separate media than the system being audited on a defin...Rule Low Severity -
SRG-APP-000125-DNS-000012
Group -
The BIND 9.x server implementation must be configured with a channel to send audit records to a local file.
DNS software administrators require DNS transaction logs for a wide variety of reasons including troubleshooting, intrusion detection, and forensics. Ensuring that the DNS transaction logs are reco...Rule Low Severity -
SRG-APP-000125-DNS-000012
Group -
The BIND 9.x server implementation must maintain at least 3 file versions of the local log file.
DNS software administrators require DNS transaction logs for a wide variety of reasons including troubleshooting, intrusion detection, and forensics. Ensuring that the DNS transaction logs are reco...Rule Low Severity -
SRG-APP-000001-DNS-000001
Group -
The BIND 9.x secondary name server must limit the number of zones requested from a single master name server.
Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name servers do not have direct user connections but accept client connections for...Rule Medium Severity -
SRG-APP-000001-DNS-000001
Group -
The BIND 9.x secondary name server must limit the total number of zones the name server can request at any one time.
Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name servers do not have direct user connections but accept client connections for...Rule Medium Severity -
SRG-APP-000001-DNS-000115
Group -
The BIND 9.x server implementation must limit the number of concurrent session client connections to the number of allowed dynamic update clients.
Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name servers do not have direct user connections but accept client connections fo...Rule Medium Severity -
SRG-APP-000142-DNS-000014
Group -
The BIND 9.x server implementation must be configured to use only approved ports and protocols.
In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable...Rule Medium Severity -
SRG-APP-000247-DNS-000036
Group -
A BIND 9.x server implementation must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks.
A DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. A denial ...Rule Medium Severity -
SRG-APP-000246-DNS-000035
Group -
A BIND 9.x server implementation must prohibit recursion on authoritative name servers.
A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers tha...Rule Medium Severity -
SRG-APP-000516-DNS-000088
Group -
The master servers in a BIND 9.x implementation must notify authorized secondary name servers when zone files are updated.
It is important to maintain the integrity of a zone file. The serial number of the SOA record is used to indicate to secondary name server that a change to the zone has occurred and a zone transfer...Rule Low Severity -
SRG-APP-000516-DNS-000088
Group -
The secondary name servers in a BIND 9.x implementation must be configured to initiate zone update notifications to other authoritative zone name servers.
It is important to maintain the integrity of a zone file. The serial number of the SOA record is used to indicate to secondary name server that a change to the zone has occurred and a zone transfer...Rule Low Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.