Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
On a BIND 9.x server all authoritative name servers for a zone must be located on different network segments.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-72507 | BIND-9X-001612 | SV-87131r1_rule | Medium |
| Description |
|---|
| Most enterprises have an authoritative primary server and a host of authoritative secondary name servers. It is essential that these authoritative name servers for an enterprise be located on different network segments. This dispersion ensures the availability of an authoritative name server not only in situations in which a particular router or switch fails but also during events involving an attack on an entire network segment. |
| STIG | Date |
|---|---|
| BIND 9.x Security Technical Implementation Guide | 2020-03-23 |
Details
| Check Text ( C-72709r1_chk ) |
|---|
| Verify that each name server listed on the BIND 9.x server is on a separate network segment. Inspect the "named.conf" file and identify all of the zone files that the BIND 9.x server is using. zone "example.com" { file "zone_file"; }; Inspect each zone file and identify each A record for each NS record listed: ns1.example.com 86400 IN A 192.168.1.4 ns2.example.com 86400 IN A 192.168.2.4 If there are name servers listed in the zone file that are not on different network segments for the specified domain, this is a finding. |
| Fix Text (F-78863r1_fix) |
|---|
| Edit the zone file and configure each name server on a separate network segment. |