STIGQter: STIG Summary: Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021: STIGQter: STIG Summary: Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:SV-215600r561297_rule
V-215600
SRG-APP-000158-DNS-000015
WDNS-IA-000002
CAT II
10
Complete the following procedures twice for each pair of name servers.
First create a rule for TCP connections.
Refer to the U_Windows_Domain_Name_Service_2008_Overview.pdf for Microsoft links for this procedure.
Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.
Press Windows Key + R, execute gpme.msc to open the Group Policy Management feature.
In the Browse for “Group Policy Object” dialog box, double-click “Domain Controllers.domain.com”.
Click “Default Domain Controllers Policy” and click “OK”.
In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP.
Right-Click “Connection Security Rules” and select “New”.
For Rule Type, select the "Server-to-server" radio button, click “Next”.
For Endpoint 1 and Endpoint 2, select "These IP addresses:" and add the IP addresses of all DNS servers, click “Next”.
For Requirements, select "Request authentication for inbound and outbound connections", click “Next”.
For Authentication Method, select Computer certificate and from the "Signing Algorithm:" drop-down, select "RSA (default)".
From the "Certificate store type:" drop-down, select "Root CA (default)”.
From the "CA name:", click “Browse” and select the certificate for the CA, click “Next”.
On Profile, accept default selections, click “Next”.
On Name, enter a name applicable to the rule's function, click “Finish”.
Note: This requirement applies to any Windows DNS Server which host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too.
If the Windows DNS Servers only host AD-integrated zones, this requirement is not applicable.
Log on to the DNS server which hosts non-AD-integrated zones using the Domain Admin or Enterprise Admin account.
Press Windows Key + R, execute gpme.msc to open the Group Policy Management feature.
In the “Browse for Group Policy Object” dialog box, double-click “Domain Controllers.domain.com”.
Click “Default Domain Controllers Policy” and click “OK”.
In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP.
Click “Connection Security Rules”.
Confirm at least one rule is configured for TCP 53.
Double-click on each Rule to verify the following:
On the “Authentication” tab, "Authentication mode:" is set to "Request authentication for inbound and outbound connections".
Confirm the "Signing Algorithm" is set to "RSA (default)".
On the “Remote Computers” tab, Endpoint1 and Endpoint2 are configured with the IP addresses of all DNS servers.
On the “Protocols and Ports” tab, "Protocol type:" is set to either TCP (depending upon which rule is being reviewed) and the "Endpoint 1 port:" is set to "Specific ports" and "53".
If there are not rules(s) configured with the specified requirements, this is a finding.
V-215600
False
WDNS-IA-000002
Note: This requirement applies to any Windows DNS Server which host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too.
If the Windows DNS Servers only host AD-integrated zones, this requirement is not applicable.
Log on to the DNS server which hosts non-AD-integrated zones using the Domain Admin or Enterprise Admin account.
Press Windows Key + R, execute gpme.msc to open the Group Policy Management feature.
In the “Browse for Group Policy Object” dialog box, double-click “Domain Controllers.domain.com”.
Click “Default Domain Controllers Policy” and click “OK”.
In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP.
Click “Connection Security Rules”.
Confirm at least one rule is configured for TCP 53.
Double-click on each Rule to verify the following:
On the “Authentication” tab, "Authentication mode:" is set to "Request authentication for inbound and outbound connections".
Confirm the "Signing Algorithm" is set to "RSA (default)".
On the “Remote Computers” tab, Endpoint1 and Endpoint2 are configured with the IP addresses of all DNS servers.
On the “Protocols and Ports” tab, "Protocol type:" is set to either TCP (depending upon which rule is being reviewed) and the "Endpoint 1 port:" is set to "Specific ports" and "53".
If there are not rules(s) configured with the specified requirements, this is a finding.
M
4016