STIGQter: STIG Summary: Infoblox 8.x DNS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Jan 2021:

The validity period for the Resource Record Signatures (RRSIGs) covering a zone's DNSKEY RRSet must be no less than two days and no more than one week.

DISA Rule

SV-233861r621666_rule

Vulnerability Number

V-233861

Group Title

SRG-APP-000516-DNS-000078

Rule Version

IDNS-8X-400003

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

1. Navigate to Data Management >> DNS >> Grid DNS properties.
2. Toggle Advanced Mode, click on the "DNSSEC" tab, and edit the "Signature Validity" setting to a period between two days and one week.
3. When complete, click "Save & Close" to save the changes and exit the "Properties" screen.
4. Any zones that used an incorrect value should perform a ZSK rollover to update the inception and expiration dates with the new value.
5. Navigate to Data Management >> DNS and select the "Zones" tab.
6. Using the zone selection check boxes and the DNSSEC drop-down menu, select "Rollover Zone-Signing Key".
7. When prompted, select "Roll Over".
8. Perform a service restart if necessary.

Check Contents

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable.

1. Navigate to Data Management >> DNS >> Grid DNS properties.
2. Toggle Advanced Mode, click on the "DNSSEC" tab, and review the "Signature Validity" setting.
3. Validate that the Signature Validity is configured for a range of no less than two days and no more than one week.
4. When complete, click "Cancel" to exit the "Properties" screen.

If the "Signature Validity" period is less than two days or greater than one week, this is a finding.

Vulnerability Number

V-233861

Documentable

False

Rule Version

IDNS-8X-400003

Severity Override Guidance

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable.

1. Navigate to Data Management >> DNS >> Grid DNS properties.
2. Toggle Advanced Mode, click on the "DNSSEC" tab, and review the "Signature Validity" setting.
3. Validate that the Signature Validity is configured for a range of no less than two days and no more than one week.
4. When complete, click "Cancel" to exit the "Properties" screen.

If the "Signature Validity" period is less than two days or greater than one week, this is a finding.

Check Content Reference

M

Target Key

5251

Comments