TMA-BIND-3.4

Restrict Queries of the Cache

Trung bìnhCấp 1Tự độngbind

Mô tả

The BIND option allow-query-cache may be used to restrict or allow BIND to provide answers to queries from the current cache of previously resolved queries. An authoritative only name server should not allow cache queries, except from the localhost, A caching only name server should allow cache queries only from the list of authorized networks. The audit passes when recursion is disabled or the global allow-query-cache list does not contain any. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
if printf '%s\n' "$opts" | grep -Eq '[{; ]recursion no;'; then echo compliant; exit 0; fi
aq=$(printf '%s\n' "$opts" | grep -Eo 'allow-query-cache \{[^}]*\}') || { echo 'no global allow-query-cache option'; exit 1; }
printf '%s\n' "$aq" | grep -Eq '[{ ]"?any"?;' && { echo 'allow-query-cache contains any'; exit 1; }
echo compliant

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Authoritative Only Name Server: For an authoritative name, insert the following either into the global options or into every zone section. allow-query-cache { localhost; }; Caching Only Name Server: Use the previously defined an ACL named trusted_clients which will identify the networks which are expected to use the DNS caching server, and will be allowed to send DNS cache queries. allow-query-cache { localhost; trusted_clients };

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: binddnsaccess-control
Tham chiếu: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 3.4 Restrict Queries of the Cache

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target bind