Configure a Logging Syslog Channel

점검 방법

감사 방식: 셸 명령

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
printf '%s\n' "$flat" | grep -Eq 'channel "?[^ ]+"? \{[^}]*[{; ]syslog( "?[a-z0-9]+"?)?;' && echo compliant || echo 'no logging syslog channel'

예상 출력

compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Configure a syslog channel to capture at least the default and general categories of log events. For external authoritative name servers, the category lame-servers may be redirect to null, so that it is not logged. Using lame name servers is common for the domains used for SPAM and may overload the log with information that is not very useful. logging { . . . // Syslog channel default_syslog { syslog daemon; # send to syslog's daemon facility severity info; # only send priority info and higher }; category default { default_syslog; }; category general { default_syslog; }; // Too many lame servers, especially from SPAM category lame-servers { null; };

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

tmaegis scan --target bind