Do Not Define a Static Source Port

OrtaDüzey 1Otomatikbind

Açıklama

BIND can be configured to always use the same source port when communicating with other DNS servers. This capability is made possible through the query-source port option, and the query-source-v6 port option. It is recommended that the source port be omitted if the query-source option is used, or that the port be specified as a *, so that the port will not be a static port ... The audit fails when any query-source or query-source-v6 statement sets a fixed port (port * / port 0 is allowed). The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
bad=$(printf '%s\n' "$flat" | grep -Eo 'query-source(-v6)? [^;]*;' | grep -E ' port [1-9][0-9]*')
[ -z "$bad" ] && echo compliant || { echo 'static query source port:'; printf '%s\n' "$bad"; }

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Either remove the port specification from the query-source or the query-source-v6 option or use an * for the port number.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: binddnsdnssec
Referans: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 7.1 Do Not Define a Static Source Port

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target bind