TMA-PFSENSE-1.7
Ensure 'DNS Rebind Check' is unchecked
MediumLevel 1Automatedpfsense
Description
Ensure that the 'DNS Rebind Check' feature is unchecked to protect against DNS rebinding attacks. FAILs when 'Disable DNS Rebinding Checks' is ticked (<nodnsrebindcheck> present); the CIS title means this box must stay unchecked. Audited against the pfSense config.xml (Diagnostics > Backup & Restore > Download configuration, or /cf/conf/config.xml).
How it is checked
Audit method: Configuration pattern
- Pattern
<nodnsrebindcheck(?:\s*/>|>[^<]*</nodnsrebindcheck>)
How it is fixed
Fix method: Guidance or infrastructure patch
GUI: System > Advanced > Admin Access: clear Disable DNS Rebinding Checks, Save. # CIS guidance: In the GUI - Navigate to System > Advance - Uncheck on 'DNS Rebind Check' Field
Properties
- Operating systems
- Any
- Tags
- pfsensehardening
- Reference
- CIS pfSense Firewall Benchmark v1.1.0 - 1.7 Ensure 'DNS Rebind Check' is unchecked
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target pfsense