TMA-OPNSENSE-1.7
Ensure 'Disable DNS Rebinding Checks' is unchecked
Description
Ensure that the 'Disable DNS Rebinding Checks' is unchecked to protect against DNS rebinding attacks. Attackers can use DNS rebinding to exploit a DNS server's response to a domain name query that resolves to a private IP address. This could provide a hacker access to private network resources that shouldn't be made available to the general public. To defend against this kind of attack, OPNsense's "DNS Rebind Check" function disables private IP responses from DNS servers. As advised in the CIS benchmark, disabling this feature would expose the system to DNS rebinding attacks.
How it is checked
Audit method: Configuration pattern
- Pattern
<nodnsrebindcheck(?:\s*/>|>[^<]*</nodnsrebindcheck>)
How it is fixed
Fix method: Guidance or infrastructure patch
In the GUI - Navigate to System -> Settings -> Administration - uncheck the 'Disable DNS Rebinding Checks' Field - Click save
Properties
- Operating systems
- Any
- Tags
- opnsense
- Reference
- CIS OPNsense Benchmark v1.0.0 - 1.7 Ensure 'Disable DNS Rebinding Checks' is unchecked
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target opnsense