STIGQter: STIG Summary: Infoblox 8.x DNS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Jan 2021:

The Infoblox system must be configured to respond to DNS traffic only.

DISA Rule

SV-233877r621666_rule

Vulnerability Number

V-233877

Group Title

SRG-APP-000516-DNS-000109

Rule Version

IDNS-8X-400019

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

1. Navigate to Grid >> Grid Manager >> Services tab.
2. Click on each service that is running and review the Service Status of each member.
3. Click on the member and select "Stop" to disable the unnecessary service.

Check Contents

By default, all services other than those required for management are disabled on Infoblox appliances. Review the Infoblox Grid for extra services turned on.

Note: Configuration of out-of-band (OOB) management can be enabled to separate DNS from management traffic if desired.

1. Navigate to Grid >> Grid Manager >> Services tab.
2. Click on each service that is running and review the Service Status of each member.

Note: Depending on purchased options, Infoblox DNS members may be running DNS, and optionally services supporting DNS and security operations such as DNS Traffic Control, Threat Protection, Threat Analytics, and TAXII services. Use of these additional Infoblox services is not a finding.

If an external authoritative server is running any unnecessary services such as file distribution services, this is a finding.

Vulnerability Number

V-233877

Documentable

False

Rule Version

IDNS-8X-400019

Severity Override Guidance

By default, all services other than those required for management are disabled on Infoblox appliances. Review the Infoblox Grid for extra services turned on.

Note: Configuration of out-of-band (OOB) management can be enabled to separate DNS from management traffic if desired.

1. Navigate to Grid >> Grid Manager >> Services tab.
2. Click on each service that is running and review the Service Status of each member.

Note: Depending on purchased options, Infoblox DNS members may be running DNS, and optionally services supporting DNS and security operations such as DNS Traffic Control, Threat Protection, Threat Analytics, and TAXII services. Use of these additional Infoblox services is not a finding.

If an external authoritative server is running any unnecessary services such as file distribution services, this is a finding.

Check Content Reference

M

Target Key

5251

Comments