BIND-9X-001150 - The BIND 9.x server signature generation using the key signing key (KSK) must be done offline, using the KSK-private key stored offline.

Information

The private key in the KSK key pair must be protected from unauthorized access. The private key must be stored offline (with respect to the internet-facing, DNSSEC-aware name server) in a physically secure, nonnetwork-accessible machine along with the zone file primary copy.

Failure to protect the private KSK may have significant effects on the overall security of the DNS infrastructure. A compromised KSK could lead to an inability to detect unauthorized DNS zone data resulting in network traffic being redirected to a rogue site.

Solution

Remove all private KSKs from the name server and ensure they are stored offline in a secure location.

Item Details

Audit Name: DISA BIND 9.x STIG v3r2

Category: IDENTIFICATION AND AUTHENTICATION

Plugin: Unix

Control ID: 7190fa0f23957b6c106b01e4e001f57b12d6f4740413f310f6d38d0186f81f38

Detections

Analytics

BIND-9X-001150 - The BIND 9.x server signature generation using the key signing key (KSK) must be done offline, using the KSK-private key stored offline.

Information

Solution

See Also

Item Details