Configure a Logging Syslog Channel

How it is checked

Audit method: Shell command

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
printf '%s\n' "$flat" | grep -Eq 'channel "?[^ ]+"? \{[^}]*[{; ]syslog( "?[a-z0-9]+"?)?;' && echo compliant || echo 'no logging syslog channel'

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Configure a syslog channel to capture at least the default and general categories of log events. For external authoritative name servers, the category lame-servers may be redirect to null, so that it is not logged. Using lame name servers is common for the domains used for SPAM and may overload the log with information that is not very useful. logging { . . . // Syslog channel default_syslog { syslog daemon; # send to syslog's daemon facility severity info; # only send priority info and higher }; category default { default_syslog; }; category general { default_syslog; }; // Too many lame servers, especially from SPAM category lame-servers { null; };

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target bind