TMA-BIND-5.3
Securely Authenticate Update Forwarding
Description
A secondary authoritative name server is allowed to accept zone updates on behalf of the primary name server, and forward them to the master name server, where the zone file can be updated. In this case, the authentication of the dynamic updates is configured with the allow-update-forwarding option. The audit requires every allow-update-forwarding list to contain only none or key <name> entries. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).
How it is checked
Audit method: Shell command
if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' ' ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' ' ' | tr -s ' ')
bad=$(printf '%s\n' "$flat" | grep -Eo '(^|[ ;{])allow-update-forwarding \{[^}]*\}' | sed 's/.*allow-update-forwarding {//; s/}$//' | tr ';' '\n' | sed 's/^ *//; s/ *$//' | grep -v '^$' | grep -Eiv '^("?none"?|key "?[^ "]+"?)$')
[ -z "$bad" ] && echo compliant || { echo 'allow-update-forwarding entries not allowed:'; printf '%s\n' "$bad" | sort -u; }- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Modify any allow-update-forwarding options to specify a securely generated TSIG or SIG(0) key identifier used by the DHCP server.
Properties
- Operating systems
- Any
- Tags
- binddnszone-transfer
- Reference
- CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 5.3 Securely Authenticate Update Forwarding
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target bind