6.1 Hide BIND Version String

Information

BIND includes a built-in zone, version.bind which may be queried to get the version of the name server. The version may be set to a value of none, to disable reporting of the version information.

Rationale:

Making detailed BIND version information easy to obtain remotely helps attackers automate and target their attacks. The information is not necessary for the health of the server, and should not be disclosed.

Solution

Add or modify the version option to have a value of none in the BIND global options, as shown below.

options {
version 'none';
. . .
}

Default Value:

Default value returns the current BIND detailed version.

See Also

https://workbench.cisecurity.org/files/2997

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CSCv6|9, CSCv7|13.2

Plugin: Unix

Control ID: 2ff552db638fc43f96e8db721143f2d740555e2c9f2c75367f4ed77f9e39b323