Enable DNSSEC Validation

中レベル 1自動bind

説明

DNS Security Extensions or DNSSEC for short provides authentication of the name servers through public key cryptography. With DNSSEC, the name server signs its responses with its private key. This allows other name servers that have the public key of the name server to verify the integrity and authenticity of the response. The audit fails when dnssec-validation or dnssec-enable is set to no (the BIND 9.11 defaults validate); the PDF also suggests the delv @127.0.0.1 isc.org "fully validated" test. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

チェック方法

監査方法: シェルコマンド

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
printf '%s\n' "$flat" | grep -Eq '[{; ]dnssec-validation no;' && { echo 'dnssec-validation no'; exit 1; }
printf '%s\n' "$flat" | grep -Eq '[{; ]dnssec-enable no;' && { echo 'dnssec-enable no'; exit 1; }
echo compliant

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Perform the following for remediation: ; Check the BIND configuration files, and in the global options set the option dnssec- enable to yes, and option dnssec-validation to either yes or auto as shown below. The auto setting is generally preferred as the trust anchor will not need to be manually configured. dnssec-enable yes dnssec-validation auto ; Restart the named server.

プロパティ

オペレーティングシステム: すべて
タグ: binddnsdnssec
参照: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 7.2 Enable DNSSEC Validation

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target bind