STIGQter: STIG Summary: Infoblox 7.x DNS Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

Only the private key corresponding to the ZSK alone must be kept on the name server that does support dynamic updates.

DISA Rule

SV-214165r612370_rule

Vulnerability Number

V-214165

Group Title

SRG-APP-000176-DNS-000094

Rule Version

IDNS-7X-000180

Severity

CAT II

CCI(s)

• CCI-000186 - The information system, for PKI-based authentication, enforces authorized access to the corresponding private key.

Weight

10

Fix Recommendation

Navigate to Data Management >> DNS >> Zones.

Selecting the zone and click "Edit", then select the "Name Servers" tab.
Mark the Grid Master as "Stealth". If no other name servers are listed, one must be added before the configuration can be valid.
When complete, click "Save & Close" to save the changes and exit the "Properties" screen.

Perform a service restart if necessary.

Check Contents

Note: For Infoblox DNS systems on a Classified network, this requirement is Not Applicable.

By default ZSK private keys are stored encrypted within the Infoblox database on the Grid Master. The Grid Master will by default enable the DNS service when DNSSEC is enabled for internal processing. No clients should be permitted to utilize the Grid Master DNS service.

Refer to the Infoblox STIG Overview document for additional information on HSM usage.

Navigate to Data Management >> DNS >> Zones.

Review each zone by selecting the zone and clicking "Edit", and selecting the "Name Servers" tab.

If the Grid Master is a listed name server and not marked "Stealth", this is a finding.

When complete, click "Cancel" to exit the "Properties" screen.

Vulnerability Number

V-214165

Documentable

False

Rule Version

IDNS-7X-000180

Severity Override Guidance

Note: For Infoblox DNS systems on a Classified network, this requirement is Not Applicable.

By default ZSK private keys are stored encrypted within the Infoblox database on the Grid Master. The Grid Master will by default enable the DNS service when DNSSEC is enabled for internal processing. No clients should be permitted to utilize the Grid Master DNS service.

Refer to the Infoblox STIG Overview document for additional information on HSM usage.

Navigate to Data Management >> DNS >> Zones.

Review each zone by selecting the zone and clicking "Edit", and selecting the "Name Servers" tab.

If the Grid Master is a listed name server and not marked "Stealth", this is a finding.

When complete, click "Cancel" to exit the "Properties" screen.

Check Content Reference

M

Target Key

3995

Comments