BIND-9X-001006 - The host running a BIND 9.x implementation must use an interface that is configured to process only DNS traffic.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

Information

Configuring hosts that run a BIND 9.X implementation to only accept DNS traffic on a DNS interface allows a system to be configured to segregate DNS traffic from all other host traffic.

The TCP/IP stack in DNS hosts (stub resolver, caching/resolving/recursive name server, authoritative name server, etc.) could be subjected to packet flooding attacks (such as SYNC and smurf), resulting in disruption of communication.

The use of a dedicated interface for DNS traffic allows for these threats to be mitigated by creating a means to limit what types of traffic can be processed using a host based firewall solution.

Solution

On the host machine, configure an interface to only process DNS traffic.

Restart the host machine.

Item Details

Audit Name: DISA BIND 9.x STIG v2r3

Plugin: Unix

Control ID: 8d4b432f211e5aec625dbb41f4a90e35cad01c8f4ac87536547f454768123f44

Detections

Analytics

BIND-9X-001006 - The host running a BIND 9.x implementation must use an interface that is configured to process only DNS traffic.

Warning! Audit Deprecated

Information

Solution

See Also

Item Details