TMA-BIND-3.4

Restrict Queries of the Cache

MédiaNível 1Automatizadabind

Descrição

The BIND option allow-query-cache may be used to restrict or allow BIND to provide answers to queries from the current cache of previously resolved queries. An authoritative only name server should not allow cache queries, except from the localhost, A caching only name server should allow cache queries only from the list of authorized networks. The audit passes when recursion is disabled or the global allow-query-cache list does not contain any. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

Como é verificado

Método de auditoria: Comando shell

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
if printf '%s\n' "$opts" | grep -Eq '[{; ]recursion no;'; then echo compliant; exit 0; fi
aq=$(printf '%s\n' "$opts" | grep -Eo 'allow-query-cache \{[^}]*\}') || { echo 'no global allow-query-cache option'; exit 1; }
printf '%s\n' "$aq" | grep -Eq '[{ ]"?any"?;' && { echo 'allow-query-cache contains any'; exit 1; }
echo compliant

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Authoritative Only Name Server: For an authoritative name, insert the following either into the global options or into every zone section. allow-query-cache { localhost; }; Caching Only Name Server: Use the previously defined an ACL named trusted_clients which will identify the networks which are expected to use the DNS caching server, and will be allowed to send DNS cache queries. allow-query-cache { localhost; trusted_clients };

Propriedades

Sistemas operacionais: Qualquer
Tags: binddnsaccess-control
Referência: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 3.4 Restrict Queries of the Cache

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target bind