Enable DNSSEC Validation

Trung bìnhCấp 1Tự độngbind

Mô tả

DNS Security Extensions or DNSSEC for short provides authentication of the name servers through public key cryptography. With DNSSEC, the name server signs its responses with its private key. This allows other name servers that have the public key of the name server to verify the integrity and authenticity of the response. The audit fails when dnssec-validation or dnssec-enable is set to no (the BIND 9.11 defaults validate); the PDF also suggests the delv @127.0.0.1 isc.org "fully validated" test. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
printf '%s\n' "$flat" | grep -Eq '[{; ]dnssec-validation no;' && { echo 'dnssec-validation no'; exit 1; }
printf '%s\n' "$flat" | grep -Eq '[{; ]dnssec-enable no;' && { echo 'dnssec-enable no'; exit 1; }
echo compliant

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Perform the following for remediation: ; Check the BIND configuration files, and in the global options set the option dnssec- enable to yes, and option dnssec-validation to either yes or auto as shown below. The auto setting is generally preferred as the trust anchor will not need to be manually configured. dnssec-enable yes dnssec-validation auto ; Restart the named server.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: binddnsdnssec
Tham chiếu: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 7.2 Enable DNSSEC Validation

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target bind