The Windows DNS Server must protect the authenticity of zone transfers via transaction signing.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259389	WDNS-22-000061	SV-259389r945324_rule		Medium

Description
Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. This applies to server-to-server (zone transfer) transactions and is provided by TSIG/SIG(0), which enforces mutual server authentication using a key that is unique to each server pair, TSIG, or using PKI-based authentication, SIG(0), thus uniquely identifying the other server. TSIG and SIG(0) are not configurable in Windows DNS Server. To meet the requirement for authentication between Windows DNS Servers, IPsec will be implemented between the Windows DNS Servers that hosts any non-Active Directory (AD)-integrated zones.

Description

Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. This applies to server-to-server (zone transfer) transactions and is provided by TSIG/SIG(0), which enforces mutual server authentication using a key that is unique to each server pair, TSIG, or using PKI-based authentication, SIG(0), thus uniquely identifying the other server. TSIG and SIG(0) are not configurable in Windows DNS Server. To meet the requirement for authentication between Windows DNS Servers, IPsec will be implemented between the Windows DNS Servers that hosts any non-Active Directory (AD)-integrated zones.

STIG	Date
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide	2024-01-09

Details

Check Text ( C-63128r945322_chk )
Note: This requirement applies to any Windows DNS Servers that host non-AD-integrated zones (file based) even if the DNS servers host AD-integrated zones, too. If the Windows DNS Servers host only AD-integrated zones, this requirement is not applicable. To protect authenticity of zone transfers between Windows DNS Servers with file-based zones, IPsec must be configured on each pair of name servers in a zone transfer transaction for those zones. Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. Press the Windows key + R and execute "gpme.msc" to open the Group Policy Management feature. In the "Browse for Group Policy Object" dialog box, double-click "Domain Controllers.domain.com". Click "Default Domain Controllers Policy" and click "OK". In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object. Click Connection Security Rules. Consult with the SA to determine which Rules meet the intent of the server-to-server authentication. If Rules exist, double-click on each Rule to verify the following: For the "Authentication:" tab, click on the "Customize..." button. On the Authentication tab, verify "Authentication mode:" is set to "Request authentication for inbound and outbound connections". Confirm the "Signing Algorithm" is set to "RSA (default)". Under "Method", ensure the "Advanced:" radio button is selected. Click the "Customize" button. For "First authentication methods:", double-click on the entry. Verify the "Select the credential to use for first authentication:" has "Computer certificate from this certification authority (CA):" radio button selected. Review the certificate specified and verify the certificate used was generated by the internally-managed server performing the Active Directory Certificate Services (AD CS) role. If rules do not exist for server-to-server authentication, this is a finding. If rules exist for this server to authenticate to other name servers hosting the same file based zones when transacting zone transfers, but the rules are not configured with the above settings, this is a finding.

Check Text ( C-63128r945322_chk )

Note: This requirement applies to any Windows DNS Servers that host non-AD-integrated zones (file based) even if the DNS servers host AD-integrated zones, too.

If the Windows DNS Servers host only AD-integrated zones, this requirement is not applicable.

To protect authenticity of zone transfers between Windows DNS Servers with file-based zones, IPsec must be configured on each pair of name servers in a zone transfer transaction for those zones.

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "gpme.msc" to open the Group Policy Management feature.

In the "Browse for Group Policy Object" dialog box, double-click "Domain Controllers.domain.com".

Click "Default Domain Controllers Policy" and click "OK".

In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object.

Click Connection Security Rules.

Consult with the SA to determine which Rules meet the intent of the server-to-server authentication.

If Rules exist, double-click on each Rule to verify the following:

For the "Authentication:" tab, click on the "Customize..." button.

On the Authentication tab, verify "Authentication mode:" is set to "Request authentication for inbound and outbound connections".

Confirm the "Signing Algorithm" is set to "RSA (default)".

Under "Method", ensure the "Advanced:" radio button is selected.

Click the "Customize" button.

For "First authentication methods:", double-click on the entry.

Verify the "Select the credential to use for first authentication:" has "Computer certificate from this certification authority (CA):" radio button selected.

Review the certificate specified and verify the certificate used was generated by the internally-managed server performing the Active Directory Certificate Services (AD CS) role.

If rules do not exist for server-to-server authentication, this is a finding.

If rules exist for this server to authenticate to other name servers hosting the same file based zones when transacting zone transfers, but the rules are not configured with the above settings, this is a finding.

Fix Text (F-63036r945323_fix)
Complete the following procedures twice for each pair of name servers. Create a rule for UDP connections and then create a rule for TCP connections. Refer to the Microsoft Windows Server DNS Overview.pdf for Microsoft links for this procedure. Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. Press the Windows key + R and execute "gpme.msc" to open the Group Policy Management feature. In the "Browse for Group Policy Object" dialog box, double-click "Domain Controllers.domain.com". Click "Default Domain Controllers Policy" and click "OK". In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object. Right-click "Connection Security Rules" and select "New". For "Rule Type", select the "Server-to-server" radio button and click "Next". For Endpoint 1 and Endpoint 2, select "These IP addresses:" and add the IP addresses of all DNS servers. Click "Next". For "Requirements", select "Request authentication for inbound and outbound connections" and click "Next". For "Authentication Method", select Computer certificate and from the "Signing Algorithm:" drop-down, select "RSA (default)". From the "Certificate store type:" drop-down, select "Root CA (default). From "CA name:", click "Browse" and select the certificate generated by the internally managed server performing the AD CS role. Click "Next". On "Profile", accept the default selections and click "Next". On "Name", enter a name applicable to the rule's function (i.e., DNSSEC UDP). Click "Finish".

Fix Text (F-63036r945323_fix)

Complete the following procedures twice for each pair of name servers.

Create a rule for UDP connections and then create a rule for TCP connections.

Refer to the Microsoft Windows Server DNS Overview.pdf for Microsoft links for this procedure.

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "gpme.msc" to open the Group Policy Management feature.

In the "Browse for Group Policy Object" dialog box, double-click "Domain Controllers.domain.com".

Click "Default Domain Controllers Policy" and click "OK".

In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object.

Right-click "Connection Security Rules" and select "New".

For "Rule Type", select the "Server-to-server" radio button and click "Next".

For Endpoint 1 and Endpoint 2, select "These IP addresses:" and add the IP addresses of all DNS servers. Click "Next".

For "Requirements", select "Request authentication for inbound and outbound connections" and click "Next".

For "Authentication Method", select Computer certificate and from the "Signing Algorithm:" drop-down, select "RSA (default)".

From the "Certificate store type:" drop-down, select "Root CA (default).

From "CA name:", click "Browse" and select the certificate generated by the internally managed server performing the AD CS role. Click "Next".

On "Profile", accept the default selections and click "Next".

On "Name", enter a name applicable to the rule's function (i.e., DNSSEC UDP).

Click "Finish".