Ignore Erroneous or Unwanted Queries

中等級 1自動化bind

說明

BIND can be configured to ignore requests originating from specified network segments. This is accomplished by implementing the blackhole option in named.conf. It is recommended that this feature be implemented to ignore requests that originate outside of expected network segments. The audit requires a non-empty blackhole address list in the global options. The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

檢查方式

稽核方法: Shell 指令

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
printf '%s\n' "$opts" | grep -Eq '[{; ]blackhole \{ *[^} ]' && echo compliant || echo 'no blackhole list in options'

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Add a blackhole option for multicast and link local addresses, and all private RFC 1918 addresses that are not being used. blackhole { // Private RFC 1918 addresses 10/8; 192.168/16; 172.16/12; // Multicast 224/8; // Link Local 169.254/16; };

屬性

作業系統: 不限
標籤: binddnsaccess-control
參考資料: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 3.1 Ignore Erroneous or Unwanted Queries

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target bind