Use Unique Keys for Each Pair of Hosts

Como é verificado

Método de auditoria: Comando shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
d=$(printf '%s\n' "$flat" | grep -Eo 'secret "[^"]*"' | sort | uniq -d | wc -l)
n=$(printf '%s\n' "$flat" | grep -Eo 'key "?[^ "]+"? \{ *algorithm' | sort | uniq -d | wc -l)
[ "$d" -eq 0 ] && [ "$n" -eq 0 ] && echo compliant || echo "duplicate key secrets: $d, duplicate key names: $n"

Saída esperada

compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Generate unique keys for host to host communication. The command below can be used to generate 2 files, a <name>.key file and a <name>.private file with secret keys of suitable length with base64 encoding. The files themselves are not needed, and should be securely deleted once the values are copied into a key file for including in the named configuration. $ dnssec-keygen -a HMAC-SHA256 -b 256 -n HOST ns1-ns2.cisecurity.org Kns1-ns2.cisecurity.org.+163+13013 $ cat Kns1-ns2.cisecurity.org.+163+13013.key ns1-ns2.cisecurity.org. IN KEY 512 3 163 9FQ2dYCQ17HJwDi/uHgANh2dlb8M7eb+F4AjML8tTdA=

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

tmaegis scan --target bind