1.5.8 Ensure DNS is servers are configured - nameserver 1

Information

The operating systems that are using DNS resolution, must have at least two name servers configured.

Rationale:

To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.

Solution

Configure the operating system to use two or more name servers for DNS resolution.
Edit the /etc/resolv.conf file to uncomment or add the two or more nameserver option lines with the IP address of local authoritative name servers. If local host resolution is being performed, the /etc/resolv.conf file must be empty. An empty /etc/resolv.conf file can be created as follows:

# echo -n > /etc/resolv.conf

And then make the file immutable with the following command:

# chattr +i /etc/resolv.conf

If the /etc/resolv.conf file must be mutable, the required configuration must be documented with the Authorizing Official and the file must be verified by the system file integrity tool.

See Also

https://workbench.cisecurity.org/files/3636

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-204608r603261_rule, STIG-ID|RHEL-07-040600

Plugin: Unix

Control ID: 1a02c24f0fece8e6ca989851de0b8f608454f82138e31aed7fe1effa895f1d7c