TMA-BIND-1.3
Dedicated Name Server Role
설명
A name server may be an authoritative name server for one or more domains for which it is configured to provide information. An authoritative-only name server only answers queries on the domains for which it is configured, and will reject queries for other domains. A caching name server will answer queries any domain. Manual review: the check needs remote queries, architecture knowledge or site policy.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
Authoritative-Only Name Server: To audit an authoritative name server, ensure it doesn't answer queries for other non- authoritative domain names. The following command may be run on a Linux system other than the name server to verify the query status is refused. $ dig @<ip_address_of_nameserver> <non_authoritative_name> | grep status; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 52410 Alternatively, the BIND configuration file name.conf and all included configuration files may be searched for the allow-recursion statement.
조치 방법
조치 방식: 가이드 또는 인프라 패치
Authoritative-Only Name Server: For the authoritative-only name server add or modify the allow-recursion statement to only include the localhost to as shown below, or add a recursion statement with a value of no as shown below. options { . . . allow-rescursion { local; }; or recursion no; Caching-Only Name Server: For the caching-only name server remove the non-local zone statements from the configuration file and restart the server.
속성
- 운영 체제
- 모두
- 태그
- binddnsarchitecture
- 참고 자료
- CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 1.3 Dedicated Name Server Role