Restrict Queries of the Cache

СреднийУровень 1Автоматическаяbind

Описание

The BIND option allow-query-cache may be used to restrict or allow BIND to provide answers to queries from the current cache of previously resolved queries. An authoritative only name server should not allow cache queries, except from the localhost, A caching only name server should allow cache queries only from the list of authorized networks. The audit passes when recursion is disabled or the global allow-query-cache list does not contain any. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

Как проверяется

Метод проверки: Команда оболочки

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
if printf '%s\n' "$opts" | grep -Eq '[{; ]recursion no;'; then echo compliant; exit 0; fi
aq=$(printf '%s\n' "$opts" | grep -Eo 'allow-query-cache \{[^}]*\}') || { echo 'no global allow-query-cache option'; exit 1; }
printf '%s\n' "$aq" | grep -Eq '[{ ]"?any"?;' && { echo 'allow-query-cache contains any'; exit 1; }
echo compliant

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Authoritative Only Name Server: For an authoritative name, insert the following either into the global options or into every zone section. allow-query-cache { localhost; }; Caching Only Name Server: Use the previously defined an ACL named trusted_clients which will identify the networks which are expected to use the DNS caching server, and will be allowed to send DNS cache queries. allow-query-cache { localhost; trusted_clients };

Свойства

Операционные системы: Любая
Теги: binddnsaccess-control
Источник: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 3.4 Restrict Queries of the Cache

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target bind