Do Not Define a Static Source Port

中レベル 1自動bind

説明

BIND can be configured to always use the same source port when communicating with other DNS servers. This capability is made possible through the query-source port option, and the query-source-v6 port option. It is recommended that the source port be omitted if the query-source option is used, or that the port be specified as a *, so that the port will not be a static port ... The audit fails when any query-source or query-source-v6 statement sets a fixed port (port * / port 0 is allowed). The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

チェック方法

監査方法: シェルコマンド

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
bad=$(printf '%s\n' "$flat" | grep -Eo 'query-source(-v6)? [^;]*;' | grep -E ' port [1-9][0-9]*')
[ -z "$bad" ] && echo compliant || { echo 'static query source port:'; printf '%s\n' "$bad"; }

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Either remove the port specification from the query-source or the query-source-v6 option or use an * for the port number.

プロパティ

オペレーティングシステム: すべて
タグ: binddnsdnssec
参照: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 7.1 Do Not Define a Static Source Port

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target bind