Ensure DNS query logging is enabled

NiskaNivo 2Automatskabind

Opis

Query logs support incident response (malware C2 lookups, data exfiltration over DNS). They are verbose, so this is a level 2 control. The audit parses named-checkconf -p output (/etc/bind/named.conf or /etc/named.conf) and passes when "querylog yes;" is set in options or the logging block routes the queries category to a channel.

Kako se proverava

Metod provere: Komanda ljuske

shell

conf=/etc/bind/named.conf; [ -f "$conf" ] || conf=/etc/named.conf
out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ')
printf '%s\n' "$flat" | grep -Eq '[{; ](querylog yes;|category "?queries"? \{)' && echo compliant

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Add to the logging block: channel query_log { file "/var/log/named/query.log" versions 5 size 50m; print-time yes; }; category queries { query_log; }; (or "querylog yes;" in options). Run named-checkconf, then rndc reconfig.

Svojstva

Operativni sistemi: Bilo koji
Oznake: binddnslogging
Referenca: CIS BIND DNS Server Benchmark - Logging / query logging (verify section number for your release)

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target bind --level 2