STIGQter: STIG Summary: Infoblox 8.x DNS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Jan 2021:

The Infoblox DNS server implementation must provide the means to indicate the security status of child zones.

DISA Rule

SV-233909r621666_rule

Vulnerability Number

V-233909

Group Title

SRG-APP-000214-DNS-000025

Rule Version

IDNS-8X-700004

Severity

CAT II

CCI(s)

• CCI-001179 - The information system, when operating as part of a distributed, hierarchical namespace, provides the means to indicate the security status of child zones.

Weight

10

Fix Recommendation

1. Navigate to Data Management >> DNS >> Zones tab.
2. Select the parent zone and use the DNSSEC drop-down menu to select "Import Keyset".
3. Add the child zone DS resource records (RRs) and select "Import".
4. Click "Save" and "Close".

Check Contents

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable.

Infoblox systems within a Grid configuration automatically publish DS records to the parent zone when the child zone is signed.

If all name servers for parent and child zones are within an Infoblox Grid, this is not a finding.

1. Review the parent zones hosted on the Infoblox server for which the child zone is on the same Infoblox Grid.
2. Verify that each zone includes the DS records for the child zone.

If DS records are not published in the parent zone for DNSSEC signed zones, this is a finding.

Vulnerability Number

V-233909

Documentable

False

Rule Version

IDNS-8X-700004

Severity Override Guidance

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable.

Infoblox systems within a Grid configuration automatically publish DS records to the parent zone when the child zone is signed.

If all name servers for parent and child zones are within an Infoblox Grid, this is not a finding.

1. Review the parent zones hosted on the Infoblox server for which the child zone is on the same Infoblox Grid.
2. Verify that each zone includes the DS records for the child zone.

If DS records are not published in the parent zone for DNSSEC signed zones, this is a finding.

Check Content Reference

M

Target Key

5251

Comments