BIND-9X-001010 - A BIND 9.x primary name server must limit the number of concurrent zone transfers between authorized secondary name servers.

CAT|II

CCI|CCI-000054

Rule-ID|SV-272364r1124029_rule

STIG-ID|BIND-9X-001010

Vuln-ID|V-272364

BIND-9X-001020 - The BIND 9.x secondary name server must limit the number of zones requested from a single primary name server.

Rule-ID|SV-272365r1124031_rule

STIG-ID|BIND-9X-001020

Vuln-ID|V-272365

BIND-9X-001030 - The BIND 9.x secondary name server must limit the total number of zones the name server can request at any one time.

Rule-ID|SV-272366r1124033_rule

STIG-ID|BIND-9X-001030

Vuln-ID|V-272366

BIND-9X-001040 - The BIND 9.x server implementation must limit the number of concurrent session client connections.

Rule-ID|SV-272367r1123978_rule

STIG-ID|BIND-9X-001040

Vuln-ID|V-272367

BIND-9X-001050 - The print-severity variable for the configuration of BIND 9.x server logs must be configured to produce audit records containing information to establish what type of events occurred.

CCI|CCI-000130

Rule-ID|SV-272368r1123822_rule

STIG-ID|BIND-9X-001050

Vuln-ID|V-272368

BIND-9X-001060 - The print-time variable for the configuration of BIND 9.x server logs must be configured to establish when (date and time) the events occurred.

CCI|CCI-000131

Rule-ID|SV-272369r1123825_rule

STIG-ID|BIND-9X-001060

Vuln-ID|V-272369

BIND-9X-001070 - The print-category variable for the configuration of BIND 9.x server logs must be configured to record information indicating which process generated the events.

CCI|CCI-000132

Rule-ID|SV-272370r1123423_rule

STIG-ID|BIND-9X-001070

Vuln-ID|V-272370

BIND-9X-001110 - A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components based on selectable event criteria and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes.

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000169

CCI|CCI-001294

CCI|CCI-001665

Rule-ID|SV-272371r1124008_rule

STIG-ID|BIND-9X-001110

Vuln-ID|V-272371

BIND-9X-001140 - The BIND 9.x server private key corresponding to the zone-signing key (ZSK) pair must be the only DNSSEC key kept on a name server that supports dynamic updates.

CCI|CCI-000186

Rule-ID|SV-272372r1123853_rule

STIG-ID|BIND-9X-001140

Vuln-ID|V-272372

BIND-9X-001150 - The BIND 9.x server signature generation using the key signing key (KSK) must be done offline, using the KSK-private key stored offline.

Rule-ID|SV-272373r1124070_rule

STIG-ID|BIND-9X-001150

Vuln-ID|V-272373

BIND-9X-001180 - The read and write access to a TSIG key file used by a BIND 9.x server must be restricted to only the account that runs the name server software.

Rule-ID|SV-272375r1123858_rule

STIG-ID|BIND-9X-001180

Vuln-ID|V-272375

BIND-9X-001190 - A unique TSIG key used by a BIND 9.x server must be generated for each pair of communicating hosts.

Rule-ID|SV-272376r1123860_rule

STIG-ID|BIND-9X-001190

Vuln-ID|V-272376

BIND-9X-001200 - The TSIG keys used with the BIND 9.x implementation must be owned by a privileged account.

Rule-ID|SV-272377r1123862_rule

STIG-ID|BIND-9X-001200

Vuln-ID|V-272377

BIND-9X-001210 - The TSIG keys used with the BIND 9.x implementation must be group owned by a privileged account.

Rule-ID|SV-272378r1123864_rule

STIG-ID|BIND-9X-001210

Vuln-ID|V-272378

BIND-9X-001220 - On a BIND 9.x server, for zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts.

CCI|CCI-000366

Rule-ID|SV-272379r1124035_rule

STIG-ID|BIND-9X-001220

Vuln-ID|V-272379

BIND-9X-001230 - On a BIND 9.x server in a split DNS configuration, where separate name servers are used between the external and internal networks, the internal name server must be configured to not be reachable from outside resolvers.

Rule-ID|SV-272380r1124037_rule

STIG-ID|BIND-9X-001230

Vuln-ID|V-272380

BIND-9X-001240 - On a BIND 9.x server in a split DNS configuration, where separate name servers are used between the external and internal networks, the external name server must be configured to not be reachable from inside resolvers.

Rule-ID|SV-272381r1124039_rule

STIG-ID|BIND-9X-001240

Vuln-ID|V-272381

BIND-9X-001250 - A BIND 9.x implementation operating in a split DNS configuration must be approved by the organization's authorizing official (AO).

Rule-ID|SV-272382r1124041_rule

STIG-ID|BIND-9X-001250

Vuln-ID|V-272382

BIND-9X-001260 - On the BIND 9.x server the IP address for hidden primary authoritative name servers must not appear in the name servers set in the zone database.

Rule-ID|SV-272383r1124043_rule

STIG-ID|BIND-9X-001260

Vuln-ID|V-272383

BIND-9X-001270 - A BIND 9.x server NSEC3 must be used for all internal DNS zones.

Rule-ID|SV-272384r1123744_rule

STIG-ID|BIND-9X-001270

Vuln-ID|V-272384

BIND-9X-001280 - On the BIND 9.x server, the private keys corresponding to both the zone signing key (ZSK) and the key signing key (KSK) must not be kept on the BIND 9.x DNSSEC-aware primary authoritative name server when the name server does not support dynamic updates.

Rule-ID|SV-272385r1124044_rule

STIG-ID|BIND-9X-001280

Vuln-ID|V-272385

BIND-9X-001290 - The two files generated by the BIND 9.x server dnssec-keygen program must be owned by the administrator account or deleted once they have been copied to the key file in the name server.

Rule-ID|SV-272386r1123985_rule

STIG-ID|BIND-9X-001290

Vuln-ID|V-272386

BIND-9X-001300 - The two files generated by the BIND 9.x server dnssec-keygen program must be group owned by the server administrator account or deleted once they have been copied to the key file in the name server.

Rule-ID|SV-272387r1123881_rule

STIG-ID|BIND-9X-001300

Vuln-ID|V-272387

BIND-9X-001310 - Permissions assigned to the dnssec-keygen keys used with the BIND 9.x implementation must enforce read-only access to the key owner and deny access to all other users.

Rule-ID|SV-272388r1124010_rule

STIG-ID|BIND-9X-001310

Vuln-ID|V-272388

BIND-9X-001320 - A BIND 9.x server validity period for the RRSIGs covering a zones DNSKEY RRSet must be no less than two days and no more than one week.

Rule-ID|SV-272389r1123885_rule

STIG-ID|BIND-9X-001320

Vuln-ID|V-272389

BIND-9X-001340 - On the BIND 9.x server, the private key corresponding to the zone signing key (ZSK), stored on name servers accepting dynamic updates, must be owned by named.

Rule-ID|SV-272390r1123888_rule

STIG-ID|BIND-9X-001340

Vuln-ID|V-272390

BIND-9X-001350 - On the BIND 9.x server, the private key corresponding to the zone signing key (ZSK), stored on name servers accepting dynamic updates, must be group owned by named.

Rule-ID|SV-272391r1123891_rule

STIG-ID|BIND-9X-001350

Vuln-ID|V-272391

BIND-9X-001360 - The BIND 9.x server implementation must prohibit the forwarding of queries to servers controlled by organizations outside of the U.S. government.

Rule-ID|SV-272392r1124046_rule

STIG-ID|BIND-9X-001360

Vuln-ID|V-272392

BIND-9X-001370 - The secondary name servers in a BIND 9.x implementation must be configured to initiate zone update notifications to other authoritative zone name servers.

Rule-ID|SV-272393r1124048_rule

STIG-ID|BIND-9X-001370

Vuln-ID|V-272393

BIND-9X-001380 - A BIND 9.x server implementation must prohibit recursion on authoritative name servers.

CCI|CCI-001094

Rule-ID|SV-272394r1124050_rule

STIG-ID|BIND-9X-001380

Vuln-ID|V-272394

BIND-9X-001390 - The primary servers in a BIND 9.x implementation must notify authorized secondary name servers when zone files are updated.

Rule-ID|SV-272395r1124052_rule

STIG-ID|BIND-9X-001390

Vuln-ID|V-272395

BIND-9X-001400 - On a BIND 9.x server, all root name servers listed in the local root zone file hosted on a BIND 9.x authoritative name server must be valid for that zone.

Rule-ID|SV-272396r1124054_rule

STIG-ID|BIND-9X-001400

Vuln-ID|V-272396

BIND-9X-001410 - On a BIND 9.x server, all root name servers listed in the local root zone file hosted on a BIND 9.x authoritative name server must be empty or removed.

Rule-ID|SV-272397r1124056_rule

STIG-ID|BIND-9X-001410

Vuln-ID|V-272397

BIND-9X-001430 - The BIND 9.x server implementation must implement internal/external role separation.

Rule-ID|SV-272399r1124058_rule

STIG-ID|BIND-9X-001430

Vuln-ID|V-272399

BIND-9X-001470 - Every NS record in a zone file on a BIND 9.x server must point to an active name server and that name server must be authoritative for the domain specified in that record.

Rule-ID|SV-272400r1123993_rule

STIG-ID|BIND-9X-001470

Vuln-ID|V-272400

BIND-9X-001480 - On a BIND 9.x server, all authoritative name servers for a zone must be located on different network segments.

Rule-ID|SV-272401r1124059_rule

STIG-ID|BIND-9X-001480

Vuln-ID|V-272401

BIND-9X-001490 - On the BIND 9.x server, the platform on which the name server software is hosted must be configured to send outgoing DNS messages from a random port.

Rule-ID|SV-272402r1124060_rule

STIG-ID|BIND-9X-001490

Vuln-ID|V-272402

BIND-9X-001500 - A BIND 9.x server implementation must be operating on a Current-Stable version as defined by ISC.

Rule-ID|SV-272403r1123995_rule

STIG-ID|BIND-9X-001500

Vuln-ID|V-272403

BIND-9X-001510 - The host running a BIND 9.x implementation must use a dedicated management interface to separate management traffic from DNS-specific traffic.

Rule-ID|SV-272404r1123996_rule

STIG-ID|BIND-9X-001510

Vuln-ID|V-272404

BIND-9X-001520 - The host running a BIND 9.x implementation must use an interface that is configured to process only DNS traffic.

Rule-ID|SV-272405r1123528_rule

STIG-ID|BIND-9X-001520

Vuln-ID|V-272405

BIND-9X-001530 - The platform on which the name server software is hosted must only run processes and services needed to support the BIND 9.x implementation.

Rule-ID|SV-272406r1123998_rule

STIG-ID|BIND-9X-001530

Vuln-ID|V-272406

BIND-9X-001540 - The core BIND 9.x server files must be group owned by a group designated for DNS administration only.

Rule-ID|SV-272407r1123534_rule

STIG-ID|BIND-9X-001540

Vuln-ID|V-272407

BIND-9X-001550 - The core BIND 9.x server files must be owned by the root or BIND 9.x process account.

Rule-ID|SV-272408r1124015_rule

STIG-ID|BIND-9X-001550

Vuln-ID|V-272408

BIND-9X-001570 - On a BIND 9.x server, all authoritative name servers for a zone must have the same version of zone information.

Rule-ID|SV-272410r1124061_rule

STIG-ID|BIND-9X-001570

Vuln-ID|V-272410

BIND-9X-001580 - On the BIND 9.x server, CNAME records must not point to a zone with lesser security for more than six months.

Rule-ID|SV-272411r1124063_rule

STIG-ID|BIND-9X-001580

Vuln-ID|V-272411

BIND-9X-001590 - On the BIND 9.x server, a zone file must not include resource records that resolve to a fully qualified domain name residing in another zone.

Rule-ID|SV-272412r1124064_rule

STIG-ID|BIND-9X-001590

Vuln-ID|V-272412

BIND-9X-001600 - The BIND 9.x name server software must run with restricted privileges.

Detections

Analytics

DISA BIND 9.x STIG v3r1

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous