TMA-BIND-3.4

Restrict Queries of the Cache

보통레벨 1자동bind

설명

The BIND option allow-query-cache may be used to restrict or allow BIND to provide answers to queries from the current cache of previously resolved queries. An authoritative only name server should not allow cache queries, except from the localhost, A caching only name server should allow cache queries only from the list of authorized networks. The audit passes when recursion is disabled or the global allow-query-cache list does not contain any. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

점검 방법

감사 방식: 셸 명령

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
if printf '%s\n' "$opts" | grep -Eq '[{; ]recursion no;'; then echo compliant; exit 0; fi
aq=$(printf '%s\n' "$opts" | grep -Eo 'allow-query-cache \{[^}]*\}') || { echo 'no global allow-query-cache option'; exit 1; }
printf '%s\n' "$aq" | grep -Eq '[{ ]"?any"?;' && { echo 'allow-query-cache contains any'; exit 1; }
echo compliant

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Authoritative Only Name Server: For an authoritative name, insert the following either into the global options or into every zone section. allow-query-cache { localhost; }; Caching Only Name Server: Use the previously defined an ACL named trusted_clients which will identify the networks which are expected to use the DNS caching server, and will be allowed to send DNS cache queries. allow-query-cache { localhost; trusted_clients };

속성

운영 체제: 모두
태그: binddnsaccess-control
참고 자료: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 3.4 Restrict Queries of the Cache

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target bind