Installing ISC BIND 9

MediumLevel 1Automatedbind

Description

The ISC BIND Benchmark recommends using the binary packages provided by your platform vendor for most situations in order to reduce the effort and increase the effectiveness of maintenance and security patches. Red Hat Enterprise Linux 7 and 8 have been used for testing the benchmark. The audit runs named -v and requires an ISC BIND 9 release; confirm the package came from the vendor (rpm -q bind / dpkg -s bind9).

How it is checked

Audit method: Shell command

shell

command -v named >/dev/null 2>&1 || [ -x /usr/sbin/named ] || exit 1
v=$( (named -v || /usr/sbin/named -v) 2>/dev/null | head -n 1)
case "$v" in 'BIND 9.'*) echo compliant ;; *) echo "named -v: ${v:-no output}"; exit 1 ;; esac

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Installation depends on the operating system platform. The following commands were tested on RHEL7 and RHEL8. On RHEL8 the yum command redirects to the newer dfm command. # yum install bind . . . # yum install bind-chroot . . .

Properties

Operating systems: Any
Tags: binddnsarchitecture
Reference: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 1.5 Installing ISC BIND 9

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target bind