Detections
Analytics
BIND-9X-002440 - The BIND 9.x server implementation must have QNAME minimization set to "strict".
Information
QNAME minimization limits the amount of information sent in DNS queries to intermediate nameservers, improving privacy by reducing the potential for DNS leak. It modifies the flow of DNS queries to reveal only what is necessary for the current server to find the next one in the resolution chain.Solution
Edit the named.conf fileoptions {
qname-minimization strict;
};
After making changes, save the named.conf file and restart the BIND service to apply the changes.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_BIND_9-x_V3R3_STIG.zip
Item Details
Audit Name: DISA BIND 9.x STIG v3r3
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-275935r1124025_rule, STIG-ID|BIND-9X-002440, Vuln-ID|V-275935
Plugin: Unix
Control ID: 049df58cefb572150303116dc5c9614fb267a0c2b358f00eaf37a6081e0cbe1d