Include Cryptographic Key Files

檢查方式

稽核方法: Shell 指令

bad=''
for f in /etc/named.conf /etc/bind/named.conf /var/named/chroot/etc/named.conf; do [ -f "$f" ] || continue; grep -Eq '^[^#/]*secret[[:space:]]+"' "$f" && bad="$bad $f"; done
[ -z "$bad" ] && echo compliant || echo "secret keys embedded in:$bad"

預期輸出

compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Move each key definition statement from the named.conf file into its own key file. It is recommended to name both the key and the key file after the two hosts that will be sharing the secret key, in order to avoid confusion. Then include the key files with include statements in the named.conf. An example is shown below with the key definition statement moved to a separate key file, however it is also accepted for only the secret statement to be moved to another file. # grep -C 1 include /etc/named.conf // Include the key file used for the host1 and host2 TSIG comms include "/etc/private/host1-host2.cisecurity.org.key"

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

tmaegis scan --target bind