The Windows 2012 DNS Server must uniquely identify the other DNS server before responding to a server-to-server transaction.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-58633	WDNS-IA-000002	SV-73063r1_rule		Medium

Description
Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. This applies to server-to-server (zone transfer) transactions only and is provided by TSIG/SIG(0), which enforces mutual server authentication using a key that is unique to each server pair (TSIG) or using PKI-based authentication (SIG(0)), thus uniquely identifying the other server. TSIG and SIG(0) are not configurable in Windows 2012 DNS Server. To meet the requirement for authentication between Windows DNS servers, IPsec will be implemented between the Windows DNS servers which host any non-AD-integrated zones.

Description

Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. This applies to server-to-server (zone transfer) transactions only and is provided by TSIG/SIG(0), which enforces mutual server authentication using a key that is unique to each server pair (TSIG) or using PKI-based authentication (SIG(0)), thus uniquely identifying the other server. TSIG and SIG(0) are not configurable in Windows 2012 DNS Server. To meet the requirement for authentication between Windows DNS servers, IPsec will be implemented between the Windows DNS servers which host any non-AD-integrated zones.

STIG	Date
Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide	2015-03-30

Details

Check Text ( C-59505r2_chk )
NOTE: This requirement applies to any Windows 2012 DNS Servers which host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too. If the Windows 2012 DNS Servers only host AD-integrated zones, this requirement is not applicable. Log on to the DNS server which hosts non-AD-integrated zones using the Domain Admin or Enterprise Admin account. Press Windows Key + R, execute gpme.msc to open the Group Policy Management feature. In the Browse for Group Policy Object dialog box, double-click Domain Controllers.domain.com. Click Default Domain Controllers Policy and click OK. In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP. Click Connection Security Rules. Consult with the SA to determine which Rules meet the intent of DNSSEC server-to-server authentication. Confirm at least one rule is configured for UDP 53 and one rule is configured for TCP 53. Double-click on each Rule to verify the following: On the Authentication tab, "Authentication mode:" is set to "Request authentication for inbound and outbound connections". Confirm the "Signing Algorithm" is set to "RSA (default)". On the Remote Computers tab, Endpoint1 and Endpoint2 are configured with the IP addresses of all DNS servers. On the Protocols and Ports tab, "Protocol type:" is set to either UDP or TCP (depending upon which rule is being reviewed) and the "Endpoint 1 port:" is set to "Specific ports" and "53". If there are not rules(s) configured with the specified requirements, this is a finding.

Check Text ( C-59505r2_chk )

NOTE: This requirement applies to any Windows 2012 DNS Servers which host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too.

If the Windows 2012 DNS Servers only host AD-integrated zones, this requirement is not applicable.

Log on to the DNS server which hosts non-AD-integrated zones using the Domain Admin or Enterprise Admin account.

Press Windows Key + R, execute gpme.msc to open the Group Policy Management feature.

In the Browse for Group Policy Object dialog box, double-click Domain Controllers.domain.com.

Click Default Domain Controllers Policy and click OK.

In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP.

Click Connection Security Rules.

Consult with the SA to determine which Rules meet the intent of DNSSEC server-to-server authentication.

Confirm at least one rule is configured for UDP 53 and one rule is configured for TCP 53.

Double-click on each Rule to verify the following:
On the Authentication tab, "Authentication mode:" is set to "Request authentication for inbound and outbound connections".

Confirm the "Signing Algorithm" is set to "RSA (default)".

On the Remote Computers tab, Endpoint1 and Endpoint2 are configured with the IP addresses of all DNS servers.

On the Protocols and Ports tab, "Protocol type:" is set to either UDP or TCP (depending upon which rule is being reviewed) and the "Endpoint 1 port:" is set to "Specific ports" and "53".

If there are not rules(s) configured with the specified requirements, this is a finding.

Fix Text (F-64017r1_fix)
Complete the following procedures twice for each pair of name servers. First create a rule for UDP connections, and then create a rule for TCP connections. Refer to the U_Windows_Domain_Name_Service_2012_Overview.pdf for Microsoft links for this procedure. Log on to the DNS server using the Domain Admin or Enterprise Admin account. Press Windows Key + R, execute gpme.msc to open the Group Policy Management feature. In the Browse for Group Policy Object dialog box, double-click Domain Controllers.domain.com. Click Default Domain Controllers Policy and click OK. In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP. Right-Click Connection Security Rules and select New. For Rule Type, select the "Server-to-server" radio button, click Next. For Endpoint 1 and Endpoint 2, select "These IP addresses:" and add the IP addresses of all DNS servers, click Next. For Requirements, select "Request authentication for inbound and outbound connections", click Next. For Authentication Method, select Computer certificate and from the "Signing Algorithm:" drop-down, select "RSA (default)". From the "Certificate store type:" drop-down, select "Root CA (default). From the "CA name:", click Browse and select the certificate for the CA, click Next. On Profile, accept default selections, click Next. On Name, enter a name applicable to the rule's function (i.e., DNSSEC UDP), click Finish.

Fix Text (F-64017r1_fix)

Complete the following procedures twice for each pair of name servers.

First create a rule for UDP connections, and then create a rule for TCP connections.

Refer to the U_Windows_Domain_Name_Service_2012_Overview.pdf for Microsoft links for this procedure.

Log on to the DNS server using the Domain Admin or Enterprise Admin account.

Press Windows Key + R, execute gpme.msc to open the Group Policy Management feature.

In the Browse for Group Policy Object dialog box, double-click Domain Controllers.domain.com.

Click Default Domain Controllers Policy and click OK.

In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP.

Right-Click Connection Security Rules and select New.

For Rule Type, select the "Server-to-server" radio button, click Next.

For Endpoint 1 and Endpoint 2, select "These IP addresses:" and add the IP addresses of all DNS servers, click Next.

For Requirements, select "Request authentication for inbound and outbound connections", click Next.

For Authentication Method, select Computer certificate and from the "Signing Algorithm:" drop-down, select "RSA (default)".

From the "Certificate store type:" drop-down, select "Root CA (default).

From the "CA name:", click Browse and select the certificate for the CA, click Next.

On Profile, accept default selections, click Next.

On Name, enter a name applicable to the rule's function (i.e., DNSSEC UDP), click Finish.