Do Not Define a Static Source Port

中等級 1自動化bind

說明

BIND can be configured to always use the same source port when communicating with other DNS servers. This capability is made possible through the query-source port option, and the query-source-v6 port option. It is recommended that the source port be omitted if the query-source option is used, or that the port be specified as a *, so that the port will not be a static port ... The audit fails when any query-source or query-source-v6 statement sets a fixed port (port * / port 0 is allowed). The audit parses the effective configuration printed by named-checkconf -p (all include files resolved) from /etc/named.conf (RHEL; chroot /var/named/chroot is detected) or /etc/bind/named.conf (Debian/Ubuntu).

檢查方式

稽核方法: Shell 指令

shell

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
bad=$(printf '%s\n' "$flat" | grep -Eo 'query-source(-v6)? [^;]*;' | grep -E ' port [1-9][0-9]*')
[ -z "$bad" ] && echo compliant || { echo 'static query source port:'; printf '%s\n' "$bad"; }

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Either remove the port specification from the query-source or the query-source-v6 option or use an * for the port number.

屬性

作業系統: 不限
標籤: binddnsdnssec
參考資料: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 7.1 Do Not Define a Static Source Port

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target bind