Configure a Logging Syslog Channel

チェック方法

監査方法: シェルコマンド

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
printf '%s\n' "$flat" | grep -Eq 'channel "?[^ ]+"? \{[^}]*[{; ]syslog( "?[a-z0-9]+"?)?;' && echo compliant || echo 'no logging syslog channel'

期待される出力

compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Configure a syslog channel to capture at least the default and general categories of log events. For external authoritative name servers, the category lame-servers may be redirect to null, so that it is not logged. Using lame name servers is common for the domains used for SPAM and may overload the log with information that is not very useful. logging { . . . // Syslog channel default_syslog { syslog daemon; # send to syslog's daemon facility severity info; # only send priority info and higher }; category default { default_syslog; }; category general { default_syslog; }; // Too many lame servers, especially from SPAM category lame-servers { null; };

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

tmaegis scan --target bind