STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

On the BIND 9.x server the IP address for hidden master authoritative name servers must not appear in the name servers set in the zone database.

DISA Rule

SV-207587r612253_rule

Vulnerability Number

V-207587

Group Title

SRG-APP-000516-DNS-000108

Rule Version

BIND-9X-001404

Severity

CAT II

CCI(s)

CCI-000366 - The organization implements the security configuration settings.

Weight

Fix Recommendation

Edit the zone file(s).

Remove all references to the hidden master name server.

Restart the BIND 9.x process.

Check Contents

If the BIND 9.x name server is not configured for split DNS, this is Not Applicable.

With the assistance of the DNS administrator, identify if the BIND 9.x implementation is using a hidden master name server, if it is not, this is Not Applicable.

In a split DNS configuration that is using a hidden master name server, verify that the name server IP address is not listed in the zone file.

With the assistance of the DNS administrator, obtain the IP address of the hidden master name server.

Inspect each zone file used by the hidden master name server and its slave zones.

If the IP address for the hidden master name server is listed in any of the zone files, this is a finding.

On the BIND 9.x server the IP address for hidden master authoritative name servers must not appear in the name servers set in the zone database.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments