UCF STIG Viewer Logo

BIND 9.x Security Technical Implementation Guide


Overview

Date Finding Count (70)
2019-01-07 CAT I (High): 8 CAT II (Med): 45 CAT III (Low): 17
STIG Description
This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.

Available Profiles



Findings (MAC III - Administrative Sensitive)

Finding ID Severity Title
V-72453 High The BIND 9.x server private key corresponding to the ZSK pair must be the only DNSSEC key kept on a name server that supports dynamic updates.
V-72429 High The BIND 9.x server implementation must uniquely identify and authenticate the other DNS server before responding to a server-to-server transaction, zone transfer and/or dynamic update request using cryptographically based bidirectional authentication to protect the integrity of the information in transit.
V-72469 High The BIND 9.x server signature generation using the KSK must be done off-line, using the KSK-private key stored off-line.
V-72489 High A BIND 9.x server implementation must implement internal/external role separation.
V-72445 High A BIND 9.x server must implement NIST FIPS-validated cryptography for provisioning digital signatures and generating cryptographic hashes.
V-72365 High A BIND 9.x server implementation must be operating on a Current-Stable version as defined by ISC.
V-72471 High A BIND 9.x server implementation must maintain the integrity and confidentiality of DNS information while it is being prepared for transmission, in transmission, and in use and t must perform integrity verification and data origin verification for all DNS information.
V-72493 High A BIND 9.x implementation operating in a split DNS configuration must be approved by the organizations Authorizing Official.
V-72407 Medium A BIND 9.x server implementation must prohibit recursion on authoritative name servers.
V-72515 Medium On the BIND 9.x server a zone file must not include resource records that resolve to a fully qualified domain name residing in another zone.
V-72439 Medium The TSIG keys used with the BIND 9.x implementation must be group owned by a privileged account.
V-72519 Medium The BIND 9.x server implementation must prohibit the forwarding of queries to servers controlled by organizations outside of the U.S. Government.
V-72437 Medium The TSIG keys used with the BIND 9.x implementation must be owned by a privileged account.
V-72431 Medium The BIND 9.x server implementation must utilize separate TSIG key-pairs when securing server-to-server transactions.
V-72423 Medium A BIND 9.x master name server must limit the number of concurrent zone transfers between authorized secondary name servers.
V-72397 Medium The BIND 9.x secondary name server must limit the number of zones requested from a single master name server.
V-72403 Medium The BIND 9.x server implementation must be configured to use only approved ports and protocols.
V-72399 Medium The BIND 9.x secondary name server must limit the total number of zones the name server can request at any one time.
V-72371 Medium The host running a BIND 9.X implementation must implement a set of firewall rules that restrict traffic on the DNS interface.
V-72373 Medium The host running a BIND 9.x implementation must use a dedicated management interface in order to separate management traffic from DNS specific traffic.
V-72367 Medium The platform on which the name server software is hosted must only run processes and services needed to support the BIND 9.x implementation.
V-72375 Medium The host running a BIND 9.x implementation must use an interface that is configured to process only DNS traffic.
V-72451 Medium Permissions assigned to the DNSSEC keys used with the BIND 9.x implementation must enforce read-only access to the key owner and deny access to all other users.
V-72487 Medium On a BIND 9.x server in a split DNS configuration, where separate name servers are used between the external and internal networks, the internal name server must be configured to not be reachable from outside resolvers.
V-72461 Medium Permissions assigned to the dnssec-keygen keys used with the BIND 9.x implementation must enforce read-only access to the key owner and deny access to all other users.
V-72485 Medium On a BIND 9.x server in a split DNS configuration, where separate name servers are used between the external and internal networks, the external name server must be configured to not be reachable from inside resolvers.
V-72481 Medium The permissions assigned to the core BIND 9.x server files must be set to utilize the least privilege possible.
V-72477 Medium The core BIND 9.x server files must be owned by the root or BIND 9.x process account.
V-72421 Medium A BIND 9.x caching name server must implement DNSSEC validation to check all DNS queries for invalid input.
V-72405 Medium A BIND 9.x server implementation must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks.
V-72425 Medium A BIND 9.x implementation configured as a caching name server must restrict recursive queries to only the IP addresses and IP address ranges of known supported clients.
V-72401 Medium The BIND 9.x server implementation must limit the number of concurrent session client connections to the number of allowed dynamic update clients.
V-72509 Medium On a BIND 9.x server all authoritative name servers for a zone must have the same version of zone information.
V-72443 Medium The BIND 9.X implementation must not utilize a TSIG or DNSSEC key for more than one year.
V-72507 Medium On a BIND 9.x server all authoritative name servers for a zone must be located on different network segments.
V-72441 Medium The read and write access to a TSIG key file used by a BIND 9.x server must be restricted to only the account that runs the name server software.
V-72505 Medium Every NS record in a zone file on a BIND 9.x server must point to an active name server and that name server must be authoritative for the domain specified in that record.
V-72447 Medium The DNSSEC keys used with the BIND 9.x implementation must be owned by a privileged account.
V-72503 Medium A BIND 9.x server NSEC3 must be used for all internal DNS zones.
V-72501 Medium A BIND 9.x server validity period for the RRSIGs covering a zones DNSKEY RRSet must be no less than two days and no more than one week.
V-72455 Medium On the BIND 9.x server the private keys corresponding to both the ZSK and the KSK must not be kept on the BIND 9.x DNSSEC-aware primary authoritative name server when the name server does not support dynamic updates.
V-72457 Medium The two files generated by the BIND 9.x server dnssec-keygen program must be owned by the root account, or deleted, after they have been copied to the key file in the name server.
V-72479 Medium The core BIND 9.x server files must be group owned by a group designated for DNS administration only.
V-72483 Medium On a BIND 9.x server for zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts.
V-72459 Medium The two files generated by the BIND 9.x server dnssec-keygen program must be group owned by the server administrator account, or deleted, after they have been copied to the key file in the name server.
V-72473 Medium A BIND 9.x server implementation must provide the means to indicate the security status of child zones.
V-72499 Medium A BIND 9.x server implementation must enforce approved authorizations for controlling the flow of information between authoritative name servers and specified secondary name servers based on DNSSEC policies.
V-72475 Medium The BIND 9.x server validity period for the RRSIGs covering the DS RR for zones delegated children must be no less than two days and no more than one week.
V-72449 Medium The DNSSEC keys used with the BIND 9.x implementation must be group owned by a privileged account.
V-72495 Medium On the BIND 9.x server the private key corresponding to the ZSK, stored on name servers accepting dynamic updates, must be owned by root.
V-72497 Medium On the BIND 9.x server the private key corresponding to the ZSK, stored on name servers accepting dynamic updates, must be group owned by root.
V-72491 Medium On the BIND 9.x server the IP address for hidden master authoritative name servers must not appear in the name servers set in the zone database.
V-72369 Medium The BIND 9.x server software must run with restricted privileges.
V-72511 Low On a BIND 9.x server all root name servers listed in the local root zone file hosted on a BIND 9.x authoritative name server must be valid for that zone.
V-72513 Low On a BIND 9.x server all root name servers listed in the local root zone file hosted on a BIND 9.x authoritative name server must be empty or removed.
V-72411 Low The secondary name servers in a BIND 9.x implementation must be configured to initiate zone update notifications to other authoritative zone name servers.
V-72517 Low On the BIND 9.x server CNAME records must not point to a zone with lesser security for more than six months.
V-72419 Low On the BIND 9.x server the platform on which the name server software is hosted must be configured to send outgoing DNS messages from a random port.
V-72393 Low The BIND 9.x server implementation must be configured with a channel to send audit records to a local file.
V-72391 Low The BIND 9.x server implementation must be configured with a channel to send audit records to a remote syslog.
V-72395 Low The BIND 9.x server implementation must maintain at least 3 file versions of the local log file.
V-72363 Low A BIND 9.x server implementation must be running in a chroot(ed) directory structure.
V-72377 Low A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components, based on selectable event criteria, and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes.
V-72409 Low The master servers in a BIND 9.x implementation must notify authorized secondary name servers when zone files are updated.
V-72379 Low The BIND 9.x server implementation must not be configured with a channel to send audit records to null.
V-72383 Low In the event of an error when validating the binding of other DNS servers identity to the BIND 9.x information, when anomalies in the operation of the signed zone transfers are discovered, for the success and failure of start and stop of the name server service or daemon, and for the success and failure of all name server events, a BIND 9.x server implementation must generate a log entry.
V-72385 Low The print-severity variable for the configuration of BIND 9.x server logs must be configured to produce audit records containing information to establish what type of events occurred.
V-72387 Low The print-time variable for the configuration of BIND 9.x server logs must be configured to establish when (date and time) the events occurred.
V-72389 Low The print-category variable for the configuration of BIND 9.x server logs must be configured to record information indicating which process generated the events.
V-72381 Low The BIND 9.x server logging configuration must be configured to generate audit records for all DoD-defined auditable events to a local file by enabling triggers for all events with a severity of info, notice, warning, error, and critical for all DNS components.