STIGQter: STIG Summary: Infoblox 8.x DNS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Jan 2021:

Infoblox systems that communicate with non-Grid name servers must use a unique Transaction Signature (TSIG).

DISA Rule

SV-233902r621666_rule

Vulnerability Number

V-233902

Group Title

SRG-APP-000176-DNS-000076

Rule Version

IDNS-8X-500005

Severity

CAT II

CCI(s)

• CCI-000186 - The information system, for PKI-based authentication, enforces authorized access to the corresponding private key.

Weight

10

Fix Recommendation

1. Navigate to Data Management >> DNS >> Zones tab.
2. Select a zone identified in the Check and click "Edit".
3. Click on the "Name Servers" tab and configure a unique TSIG key for each non-Grid Name Server, designated as type Ext.
4. Verify that the same TSIG key (Algorithm and Key Data) are configured on both name servers.
5. Click on the "Zone Transfers" tab.
6. If the Name Server configured above is not present, click "Override" for the "Allow Zone Transfers to" section. Use the radio button to select "Set of ACEs" and the "Add" drop-down to configure the Name Server configured above.
7. When complete, click "Save & Close" to save the changes and exit the "Properties" screen.
8. Repeat for any other zones identified in the Check as non-compliant.
9. Perform a service restart if necessary.
10. Verify zone transfers are operational after configuration of TSIG.

Note: HMAC-SHA256 is the preferred algorithm to generate TSIG keys and should be used unless the External name server only supports HMAC-MD5.

Check Contents

1. Navigate to Data Management >> DNS >> Zones tab.
2. Review each zone by clicking "Edit" and inspecting the "Name Servers" tab.
3. If the all entries in the "Type" column are configured as "Grid", this check is Not Applicable.
4. Verify that all Name Servers of type Ext (Primary or Secondary) have a TSIG key configured.
5. Each zone that contains Ext non-Grid name servers must also be verified by inspection of the "Zone Transfers" tab and configuration of an Access Control Entry (ACE) that limits access to only the TSIG configured Name Servers.
6. When complete, click "Cancel" to exit the "Properties" screen.

If there is an external non-Grid system that uses zone transfers but does not have a Name Server with a unique TSIG key, this is a finding.

Vulnerability Number

V-233902

Documentable

False

Rule Version

IDNS-8X-500005

Severity Override Guidance

1. Navigate to Data Management >> DNS >> Zones tab.
2. Review each zone by clicking "Edit" and inspecting the "Name Servers" tab.
3. If the all entries in the "Type" column are configured as "Grid", this check is Not Applicable.
4. Verify that all Name Servers of type Ext (Primary or Secondary) have a TSIG key configured.
5. Each zone that contains Ext non-Grid name servers must also be verified by inspection of the "Zone Transfers" tab and configuration of an Access Control Entry (ACE) that limits access to only the TSIG configured Name Servers.
6. When complete, click "Cancel" to exit the "Properties" screen.

If there is an external non-Grid system that uses zone transfers but does not have a Name Server with a unique TSIG key, this is a finding.

Check Content Reference

M

Target Key

5251

Comments