STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

In the event of an error when validating the binding of other DNS servers identity to the BIND 9.x information, when anomalies in the operation of the signed zone transfers are discovered, for the success and failure of start and stop of the name server service or daemon, and for the success and failure of all name server events, a BIND 9.x server implementation must generate a log entry.

DISA Rule

SV-207542r612253_rule

Vulnerability Number

V-207542

Group Title

SRG-APP-000350-DNS-000044

Rule Version

BIND-9X-001021

Severity

CAT III

CCI(s)

• CCI-001906 - The information system performs organization-defined actions in the event of an error when validating the binding of the information producer identity to the information.
• CCI-000172 - The information system generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
• CCI-000366 - The organization implements the security configuration settings.
• CCI-002702 - The information system shuts the information system down, restarts the information system, and/or initiates organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.

Weight

10

Fix Recommendation

Edit the "named.conf" file.

Add the "severity" sub statement to the "channel" statement.

Configure the "severity" sub statement to "info"

Restart the BIND 9.x process.

Check Contents

Verify the name server is configured to log error messages with a severity of “info”:

Inspect the "named.conf" file for the following:

logging {
channel channel_name {
severity info;
};

If the "severity" sub statement is not set to "info", this is a finding.

Note: Setting the "severity" sub statement to "info" will log all messages for the following severity levels: Critical, Error, Warning, Notice, and Info.

Vulnerability Number

V-207542

Documentable

False

Rule Version

BIND-9X-001021

Severity Override Guidance

Verify the name server is configured to log error messages with a severity of “info”:

Inspect the "named.conf" file for the following:

logging {
channel channel_name {
severity info;
};

If the "severity" sub statement is not set to "info", this is a finding.

Note: Setting the "severity" sub statement to "info" will log all messages for the following severity levels: Critical, Error, Warning, Notice, and Info.

Check Content Reference

M

Target Key

2926

Comments