Detections
Analytics

3.4 Ensure at least two name servers are configured if using DNS resolution

Information

For operating systems using DNS resolution, at least two name servers must be configured.

To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.

Solution

Configure the operating system to use two or more name servers for DNS resolution.

By default, "NetworkManager" on RHEL 8 operating systems dynamically updates the /etc/resolv.conf file with the DNS settings from active "NetworkManager" connection profiles. However, this feature can be disabled to allow manual configurations.

If manually configuring DNS, edit the "/etc/resolv.conf" file to uncomment or add the two or more "nameserver" option lines with the IP address of local authoritative name servers. If local host resolution is being performed, the "/etc/resolv.conf" file must be empty. An empty "/etc/resolv.conf" file can be created as follows:

# echo -n > /etc/resolv.conf

See Also

https://workbench.cisecurity.org/benchmarks/19886

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, Rule-ID|SV-230316r627750_rule, Vuln-ID|V-230316

Plugin: Unix

Control ID: 6e860caf05744df3d81946c7640c07c047231df7544fb452f2459497172c3790