Securely Authenticate Update Forwarding

中级别 1自动化bind

说明

A secondary authoritative name server is allowed to accept zone updates on behalf of the primary name server, and forward them to the master name server, where the zone file can be updated. In this case, the authentication of the dynamic updates is configured with the allow-update-forwarding option. The audit requires every allow-update-forwarding list to contain only none or key <name> entries. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

检查方式

审计方法: Shell 命令

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
bad=$(printf '%s\n' "$flat" | grep -Eo '(^|[ ;{])allow-update-forwarding \{[^}]*\}' | sed 's/.*allow-update-forwarding {//; s/}$//' | tr ';' '\n' | sed 's/^ *//; s/ *$//' | grep -v '^$' | grep -Eiv '^("?none"?|key "?[^ "]+"?)$')
[ -z "$bad" ] && echo compliant || { echo 'allow-update-forwarding entries not allowed:'; printf '%s\n' "$bad" | sort -u; }

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Modify any allow-update-forwarding options to specify a securely generated TSIG or SIG(0) key identifier used by the DHCP server.

属性

操作系统: 任意
标签: binddnszone-transfer
参考: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 5.3 Securely Authenticate Update Forwarding

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target bind