TMA-BIND-5.3

Securely Authenticate Update Forwarding

MediaNivel 1Automatizadabind

Descripción

A secondary authoritative name server is allowed to accept zone updates on behalf of the primary name server, and forward them to the master name server, where the zone file can be updated. In this case, the authentication of the dynamic updates is configured with the allow-update-forwarding option. The audit requires every allow-update-forwarding list to contain only none or key <name> entries. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

Cómo se verifica

Método de auditoría: Comando de shell

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
bad=$(printf '%s\n' "$flat" | grep -Eo '(^|[ ;{])allow-update-forwarding \{[^}]*\}' | sed 's/.*allow-update-forwarding {//; s/}$//' | tr ';' '\n' | sed 's/^ *//; s/ *$//' | grep -v '^$' | grep -Eiv '^("?none"?|key "?[^ "]+"?)$')
[ -z "$bad" ] && echo compliant || { echo 'allow-update-forwarding entries not allowed:'; printf '%s\n' "$bad" | sort -u; }

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Modify any allow-update-forwarding options to specify a securely generated TSIG or SIG(0) key identifier used by the DHCP server.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: binddnszone-transfer
Referencia: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 5.3 Securely Authenticate Update Forwarding

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target bind