Set root Ownership of BIND Configuration Files

How it is checked

Audit method: Shell command

BH=''; for d in /var/named /etc/bind /var/cache/bind; do [ -d "$d" ] && BH="$BH $d"; done
[ -n "$BH" ] || { echo 'no BIND directory found'; exit 1; }
RUN=''; for d in /run/named /var/run/named; do [ -d "$d" ] && { RUN=$d; break; }; done
G='-group root'; U='-user root'; for a in named bind; do grep -q "^$a:" /etc/group 2>/dev/null && G="$G -o -group $a"; grep -q "^$a:" /etc/passwd 2>/dev/null && U="$U -o -user $a"; done
RT='^(/var/named(/chroot/var/named)?/(dynamic|slaves|data)|/var/named/chroot/(var/)?run/named|/var/named/chroot/var/log|/var/named/chroot/(var/)?tmp|/var/cache/bind|/run/named|/var/run/named)(/|$)'
out=$(find $BH -type f \! -user root -print 2>/dev/null | { grep -Ev "$RT" || true; }) || exit 1
[ -z "$out" ] && echo compliant || { printf '%s\n' "$out" | head -n 20; echo 'files not owned by root'; }

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Perform the following: ; Capture the output of the previous audit command to a file named nonroot- files.txt and review any files not owned by root to ensure the files are necessary and are not expected run-time files. Delete any unnecessary files, and ensure any run-time files are being created in the appropriate run-time directory. # find $BIND_HOME -type f \! -user root | egrep -v \ \^$DYNDIR\|\^$SLAVEDIR\|\^$DATADIR\|\^$RUNDIR\|\^$LOGDIR\|\^$TMPDIR > \ $TMPDIR/nonroot-files.txt ; The remaining non-run-time files should be changed to be owned by root, with a command like the following: \# cat $TMPDIR/nonroot-files.txt | xargs chown root \# rm $TMPDIR/nonroot-files.txt

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target bind