Detections
Analytics
BIND-9X-001480 - On a BIND 9.x server, all authoritative name servers for a zone must be located on different network segments.
Information
Most enterprises have an authoritative primary server and a host of authoritative secondary name servers. It is essential that these authoritative name servers for an enterprise be located on different network segments. This dispersion ensures the availability of an authoritative name server not only in situations in which a particular router or switch fails but also during events involving an attack on an entire network segment.NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Edit the zone file and configure each name server on a separate network segment.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_BIND_9-x_V3R2_STIG.zip
Item Details
Audit Name: DISA BIND 9.x STIG v3r2
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-272401r1156953_rule, STIG-ID|BIND-9X-001480, Vuln-ID|V-272401
Plugin: Unix
Control ID: 2a6c6e833f4a281f423beee5fbf14e9e9e1680019ab040378f8d7c0efbbb79c0