BIND-9X-001220 - On a BIND 9.x server, for zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts.

Information

Authoritative name servers for an enterprise may be configured to receive requests from both external and internal clients.

External clients need to receive RRs that pertain only to public services (public web server, mail server, etc.).

Internal clients need to receive RRs pertaining to public services as well as internal hosts.

The zone information that serves the RRs on both the inside and outside of a firewall must be split into different physical files for these two types of clients (one file for external clients and one file for internal clients).

Solution

Edit the "named.conf" file.

Configure the internal and external view statements to use separate zone files.

Edit the internal and external zone files.

Configure the zone file to use RRs designated for internal or external use. The zone files must not share any RR.

Item Details

Audit Name: DISA BIND 9.x STIG v3r1

Category: CONFIGURATION MANAGEMENT

Plugin: Unix

Control ID: 966cffe68a3a02832e856bddfd8d4c44b7690632f765539e47f12978aad9e04f

Detections

Analytics

BIND-9X-001220 - On a BIND 9.x server, for zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts.

Information

Solution

See Also

Item Details