Use Secure Upstream Caching DNS Servers

낮음레벨 2수동 검토bind

설명

Caching name servers often forward queries to another caching name server to allow the name service work to be aggregated and improve performance by taking advantage of the cache of an upstream name server. The default caching name server provided by the Internet service provider is often used in this manner. Manual review: the check needs remote queries, architecture knowledge or site policy.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Perform the following for an audit: ; Check the network architecture and the identify all internal authorized caching DNS servers configured via DHCP or statically. ; Verify that there are network firewall and access controls rules that prevent internal systems from sending DNS queries directly to unauthorized external DNS servers. Only the authorized internal DNS servers should be allowed to send external DNS queries and they should be configured to only use authorized external DNS servers.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Perform the following for remediation: ; Select an external DNS provider that sufficiently mitigates malicious DNS traffic to meet your organizational requirements. ; Review network architectural, approved internal DNS servers, and prepare to block outbound DNS traffic, except to the approved DNS servers from the internal caching name servers. ; Review, test and document the approved external DNS servers. ; Configure the internal caching-only DNS servers to forward queries to the approved external caching DNS server. The forwarders directive similar to the example below may be placed in the server options directive. forwarders { acl_of_approved_servers; }

속성

운영 체제: 모두
태그: binddnsarchitecture
참고 자료: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 1.4 Use Secure Upstream Caching DNS Servers