STIGQter: STIG Summary: Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021: STIGQter: STIG Summary: Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:SV-215629r561297_rule
V-215629
SRG-APP-000427-DNS-000060
WDNS-SC-000022
CAT II
10
Complete the following procedures twice for each pair of name servers.
First create a rule for UDP connections, and then create a rule for TCP connections.
Refer to the U_Windows_Domain_Name_Service_2012_Overview.pdf for Microsoft links for this procedure.
Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.
Press Windows Key + R, execute gpme.msc to open the Group Policy Management feature.
In the Browse for Group Policy Object dialog box, double-click Domain Controllers.domain.com.
Click Default Domain Controllers Policy and click OK.
In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP.
Right-Click Connection Security Rules and select New.
For Rule Type, select the "Server-to-server" radio button, click Next.
For Endpoint 1 and Endpoint 2, select "These IP addresses:" and add the IP addresses of all DNS servers, click Next.
For Requirements, select "Request authentication for inbound and outbound connections", click Next.
For Authentication Method, select Computer certificate and from the "Signing Algorithm:" drop-down, select "RSA (default)".
From the "Certificate store type:" drop-down, select "Root CA (default).
From the "CA name:", click Browse and select the certificate generated by the internally-managed server performing the Active Directory Certificate Services (AD CS) role, click Next.
On Profile, accept default selections, click Next.
On Name, enter a name applicable to the rule's function (i.e., DNSSEC UDP), click Finish.
NOTE: This requirement applies to any Windows 2012 DNS Servers which host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too.
Note: This requirement is not applicable to servers with only a caching role.
If the Windows 2012 DNS Servers only host AD-integrated zones, this requirement is not applicable.
Log on to the DNS server which hosts non-AD-integrated zones using the Domain Admin or Enterprise Admin account.
Press Windows Key + R, execute gpme.msc to open the Group Policy Management feature.
In the Browse for Group Policy Object dialog box, double-click Domain Controllers.domain.com.
Click Default Domain Controllers Policy and click OK.
In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP.
Click Connection Security Rules.
Consult with the SA to determine which Rules meet the intent of DNSSEC server-to-server authentication.
Double-click on each Rule to verify the following:
For the "Authentication:" tab, click on the "Customize..." button.
On the Authentication tab, verify "Authentication mode:" is set to "Request authentication for inbound and outbound connections".
Confirm the "Signing Algorithm" is set to "RSA (default)".
Under "Method", ensure the "Advanced:" radio button is selected. Click on the "Customize" button.
For "First authentication methods:", double-click on the entry.
Verify the "Select the credential to use for first authentication:" has "Computer certificate from this certification authority (CA):" radio button selected.
Review the certificate specified and verify the certificate used was generated by the internally-managed server performing the Active Directory Certificate Services (AD CS) role.
If the certificate used does not meet the requirements, this is a finding.
V-215629
False
WDNS-SC-000022
NOTE: This requirement applies to any Windows 2012 DNS Servers which host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too.
Note: This requirement is not applicable to servers with only a caching role.
If the Windows 2012 DNS Servers only host AD-integrated zones, this requirement is not applicable.
Log on to the DNS server which hosts non-AD-integrated zones using the Domain Admin or Enterprise Admin account.
Press Windows Key + R, execute gpme.msc to open the Group Policy Management feature.
In the Browse for Group Policy Object dialog box, double-click Domain Controllers.domain.com.
Click Default Domain Controllers Policy and click OK.
In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP.
Click Connection Security Rules.
Consult with the SA to determine which Rules meet the intent of DNSSEC server-to-server authentication.
Double-click on each Rule to verify the following:
For the "Authentication:" tab, click on the "Customize..." button.
On the Authentication tab, verify "Authentication mode:" is set to "Request authentication for inbound and outbound connections".
Confirm the "Signing Algorithm" is set to "RSA (default)".
Under "Method", ensure the "Advanced:" radio button is selected. Click on the "Customize" button.
For "First authentication methods:", double-click on the entry.
Verify the "Select the credential to use for first authentication:" has "Computer certificate from this certification authority (CA):" radio button selected.
Review the certificate specified and verify the certificate used was generated by the internally-managed server performing the Active Directory Certificate Services (AD CS) role.
If the certificate used does not meet the requirements, this is a finding.
M
4016