STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

The secondary name servers in a BIND 9.x implementation must be configured to initiate zone update notifications to other authoritative zone name servers.

DISA Rule

SV-207556r612253_rule

Vulnerability Number

V-207556

Group Title

SRG-APP-000516-DNS-000088

Rule Version

BIND-9X-001058

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Edit the "named.conf" file.

Configure the "notify" sub statement in the "options" statement block to "no":

options {
notify no;
};

Configure the “notify explicit” and "also-notify" sub statements in the zone statement block to limit zone transfer notifications to authorized secondary name servers:

zone example.com {
notify explicit;
also-notify { <ip_address>; | <address_match_list>; };

Restart the BIND 9.x process.

Check Contents

If this is a master name server, this is Not Applicable.

On a secondary name server, verify that the global notify is disabled. The global entry for the name server is under the “Options” section and notify should be disabled at this section.

Inspect the "named.conf" file for the following:

options {
notify no;
};

If the "notify" statement is missing, this is a finding.
If the "notify" statement is set to "yes", this is a finding.

Verify that zones for which the secondary server is authoritative is configured to notify other authorized secondary name servers when a zone file update has been received from the master name server for the zone.
Each zone has its own Zone section.

Inspect the "named.conf" file for the following:

zone example.com {
notify explicit;
also-notify { <ip_address>; | <address_match_list>; };

If an "address match list" is used, verify that each ip address listed is an authorized secondary name server for that zone.

If the “notify explicit” statement is missing, this is a finding.
If the "also-notify" statement is missing, this is a finding.
If the "also-notify" statement is configured to notify name servers that are not authorized for that zone, this is a finding.

Vulnerability Number

V-207556

Documentable

False

Rule Version

BIND-9X-001058

Severity Override Guidance

If this is a master name server, this is Not Applicable.

On a secondary name server, verify that the global notify is disabled. The global entry for the name server is under the “Options” section and notify should be disabled at this section.

Inspect the "named.conf" file for the following:

options {
notify no;
};

If the "notify" statement is missing, this is a finding.
If the "notify" statement is set to "yes", this is a finding.

Verify that zones for which the secondary server is authoritative is configured to notify other authorized secondary name servers when a zone file update has been received from the master name server for the zone.
Each zone has its own Zone section.

Inspect the "named.conf" file for the following:

zone example.com {
notify explicit;
also-notify { <ip_address>; | <address_match_list>; };

If an "address match list" is used, verify that each ip address listed is an authorized secondary name server for that zone.

If the “notify explicit” statement is missing, this is a finding.
If the "also-notify" statement is missing, this is a finding.
If the "also-notify" statement is configured to notify name servers that are not authorized for that zone, this is a finding.

Check Content Reference

M

Target Key

2926

Comments