TMA-BIND-3.4

Restrict Queries of the Cache

OrtaDüzey 1Otomatikbind

Açıklama

The BIND option allow-query-cache may be used to restrict or allow BIND to provide answers to queries from the current cache of previously resolved queries. An authoritative only name server should not allow cache queries, except from the localhost, A caching only name server should allow cache queries only from the list of authorized networks. The audit passes when recursion is disabled or the global allow-query-cache list does not contain any. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
if printf '%s\n' "$opts" | grep -Eq '[{; ]recursion no;'; then echo compliant; exit 0; fi
aq=$(printf '%s\n' "$opts" | grep -Eo 'allow-query-cache \{[^}]*\}') || { echo 'no global allow-query-cache option'; exit 1; }
printf '%s\n' "$aq" | grep -Eq '[{ ]"?any"?;' && { echo 'allow-query-cache contains any'; exit 1; }
echo compliant

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Authoritative Only Name Server: For an authoritative name, insert the following either into the global options or into every zone section. allow-query-cache { localhost; }; Caching Only Name Server: Use the previously defined an ACL named trusted_clients which will identify the networks which are expected to use the DNS caching server, and will be allowed to send DNS cache queries. allow-query-cache { localhost; trusted_clients };

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: binddnsaccess-control
Referans: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 3.4 Restrict Queries of the Cache

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target bind