Enable DNSSEC Validation

MittelStufe 1Automatisiertbind

Beschreibung

DNS Security Extensions or DNSSEC for short provides authentication of the name servers through public key cryptography. With DNSSEC, the name server signs its responses with its private key. This allows other name servers that have the public key of the name server to verify the integrity and authenticity of the response. The audit fails when dnssec-validation or dnssec-enable is set to no (the BIND 9.11 defaults validate); the PDF also suggests the delv @127.0.0.1 isc.org "fully validated" test. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

So wird geprüft

Prüfmethode: Shell-Befehl

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
printf '%s\n' "$flat" | grep -Eq '[{; ]dnssec-validation no;' && { echo 'dnssec-validation no'; exit 1; }
printf '%s\n' "$flat" | grep -Eq '[{; ]dnssec-enable no;' && { echo 'dnssec-enable no'; exit 1; }
echo compliant

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Perform the following for remediation: ; Check the BIND configuration files, and in the global options set the option dnssec- enable to yes, and option dnssec-validation to either yes or auto as shown below. The auto setting is generally preferred as the trust anchor will not need to be manually configured. dnssec-enable yes dnssec-validation auto ; Restart the named server.

Eigenschaften

Betriebssysteme: Beliebig
Tags: binddnsdnssec
Referenz: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 7.2 Enable DNSSEC Validation

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target bind