TMA-BIND-3.1

Ignore Erroneous or Unwanted Queries

SrednjaNivo 1Automatskabind

Opis

BIND can be configured to ignore requests originating from specified network segments. This is accomplished by implementing the blackhole option in named.conf. It is recommended that this feature be implemented to ignore requests that originate outside of expected network segments. The audit requires a non-empty blackhole address list in the global options. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

Kako se proverava

Metod provere: Komanda ljuske

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
printf '%s\n' "$opts" | grep -Eq '[{; ]blackhole \{ *[^} ]' && echo compliant || echo 'no blackhole list in options'

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Add a blackhole option for multicast and link local addresses, and all private RFC 1918 addresses that are not being used. blackhole { // Private RFC 1918 addresses 10/8; 192.168/16; 172.16/12; // Multicast 224/8; // Link Local 169.254/16; };

Svojstva

Operativni sistemi: Bilo koji
Oznake: binddnsaccess-control
Referenca: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 3.1 Ignore Erroneous or Unwanted Queries

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target bind