Enable DNSSEC Validation

SedangLevel 1Otomatisbind

Deskripsi

DNS Security Extensions or DNSSEC for short provides authentication of the name servers through public key cryptography. With DNSSEC, the name server signs its responses with its private key. This allows other name servers that have the public key of the name server to verify the integrity and authenticity of the response. The audit fails when dnssec-validation or dnssec-enable is set to no (the BIND 9.11 defaults validate); the PDF also suggests the delv @127.0.0.1 isc.org "fully validated" test. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

Cara pemeriksaan

Metode audit: Perintah shell

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
printf '%s\n' "$flat" | grep -Eq '[{; ]dnssec-validation no;' && { echo 'dnssec-validation no'; exit 1; }
printf '%s\n' "$flat" | grep -Eq '[{; ]dnssec-enable no;' && { echo 'dnssec-enable no'; exit 1; }
echo compliant

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Perform the following for remediation: ; Check the BIND configuration files, and in the global options set the option dnssec- enable to yes, and option dnssec-validation to either yes or auto as shown below. The auto setting is generally preferred as the trust anchor will not need to be manually configured. dnssec-enable yes dnssec-validation auto ; Restart the named server.

Properti

Sistem operasi: Apa saja
Tag: binddnsdnssec
Referensi: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 7.2 Enable DNSSEC Validation

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target bind