STIGQter STIGQter: STIG Summary: Infoblox 8.x DNS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Jan 2021:

All authoritative name servers for a zone must have the same version of zone information.

DISA Rule

SV-233865r621666_rule

Vulnerability Number

V-233865

Group Title

SRG-APP-000516-DNS-000088

Rule Version

IDNS-8X-400007

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Serial numbers are updated automatically when changes are made to a zone through the Infoblox Grid, as well as through the notify process for external DNS servers. If a serial number mismatch is discovered, troubleshooting of both server configurations and network will be required. Protocol configuration issues will be logged in the Infoblox Grid Members SYSLOG.

1. Navigate to Administration >> Logs >> Syslog.
2. Infoblox Grid Members can be selected using the drop-down menu.
3. Stand-alone systems will not display a drop-down menu; the log data will be displayed automatically.
4. Review the SYSLOG data and resolve the issue that is preventing updates.

Check Contents

Review DNS zone data to validate the SOA on all authoritative DNS servers. Remote name servers that do not have the same serial number as the primary name server may have network issues or misconfiguration blocking updates.

Use either the "nslookup" or "dig" utility to review the serial number returned from each name server.

Example:
Using the "dig" utility, enter the command line as follows: "dig @NAMESERVER-IP ZONE SOA". $ dig @192.168.0.1 blue.org SOA ;; ANSWER SECTION: blue.org. 28800 IN SOA ns.blue.org. postmaster.blue.org. 20200922 10800 3600 2419200 900

The SOA RR specifies the serial number as the third RDATA field; in this example, it is 20200922.

If any serial numbers for the same zone do not match, this is a finding.

Vulnerability Number

V-233865

Documentable

False

Rule Version

IDNS-8X-400007

Severity Override Guidance

Review DNS zone data to validate the SOA on all authoritative DNS servers. Remote name servers that do not have the same serial number as the primary name server may have network issues or misconfiguration blocking updates.

Use either the "nslookup" or "dig" utility to review the serial number returned from each name server.

Example:
Using the "dig" utility, enter the command line as follows: "dig @NAMESERVER-IP ZONE SOA". $ dig @192.168.0.1 blue.org SOA ;; ANSWER SECTION: blue.org. 28800 IN SOA ns.blue.org. postmaster.blue.org. 20200922 10800 3600 2419200 900

The SOA RR specifies the serial number as the third RDATA field; in this example, it is 20200922.

If any serial numbers for the same zone do not match, this is a finding.

Check Content Reference

M

Target Key

5251

Comments