Detections
Analytics

4.3.2.8 Ensure dns server services are not in use

Information

The named daemon is the server for the DNS protocol and controls domain name resolution for its clients.

Unless a system is specifically designated to act as a DNS server, it is recommended that the named fileset be removed to reduce the potential attack surface.

Solution

Run the following command to remove the software:

# /usr/sbin/installp -u bos.net.tcp.bind bos.net.tcp.server bind.rte

- OR -

- IF - the bos.net.tcp.bind or bind.rte filesets are required as a dependency:

Run the following script to stop and disable named

#!/usr/bin/ksh
DAEMONS="named"
for l_daemon in $DAEMONS;
do
 /usr/sbin/chrctcp -d $l_daemon
 /usr/bin/stopsrc -s $l_daemon
done

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CCI|CCI-000381, CSCv7|9.2, Rule-ID|SV-215360r958478_rule, Vuln-ID|V-215360

Plugin: Unix

Control ID: 3c559ab1956fe014e1c8d95f9924e1f7b535c7b9de6d035f7de9f2efb99c272d