STIGQter: STIG Summary: F5 BIG-IP TMOS DNS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Sep 2024:

The F5 BIG-IP DNS must use valid root name servers in the local root zone file.

DISA Rule

SV-265984r1024858_rule

Vulnerability Number

V-265984

Group Title

SRG-APP-000516-DNS-000102

Rule Version

F5BI-DN-300015

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

This is only applicable if DNS recursion is being performed by the BIG-IP AND a custom root hint list must be defined.

Enable recursion for named:
From the BIG-IP GUI:
1. DNS.
2. Zones.
3. ZoneRunner.
4. Named Configuration.
5. Change the recursion option to "recursion yes;".
6. Click "Update".

Create a hint zone using ZoneRunner:
From the BIG-IP GUI:
1. DNS.
2. Zones.
3. ZoneRunner.
4. Zone List.
5. Create.
6. For the View Name option, select the view for which the hint zone will apply.
7. For the Zone Name, enter a period character "." (without quotes).
8. For the Zone Type, select "Hint".
9. Change the Zone File Name to "db.external.named.root." (without quotes).
10. Click "Finished".

Edit the hint zone file:
From the BIG-IP CLI:
1. Edit the root hint file:
vi /var/named/config/namedb/db.external.named.root.
2. Paste the list of valid root name servers. Note: A copy of the latest root server list can be found at the following location:
http://www.internic.net/zones/named.cache.
3. Save the file.
4. Update the time stamp on: /var/named/config/named.conf
touch /var/named/config/named.conf
5. Restart named:
tmsh restart /sys service named
6. Restart zrd:
tmsh restart /sys service zrd

Note: The hint zone does not display any information when viewed in the ZoneRunner Configuration utility. The information is used by named for the purpose of querying and receiving the most up-to-date list of root servers. It cannot be updated or modified using the ZoneRunner utility.

Check Contents

This is only applicable if DNS recursion is being performed by the BIG-IP AND a custom root hint list must be defined.

From the BIG-IP GUI:
1. DNS.
2. Zones.
3. ZoneRunner.
4. Zone List.
5. Verify there is no Zone Name called ".".
6. If a "." Zone Name exists, log in to the BIG-IP CLI and run the following commands:
cat /var/named/config/namedb/db.external.named.root.
7. Verify valid root name servers are configured.

If the BIG-IP appliance is not configured to use valid root name servers in the local root zone file, this is a finding.

Vulnerability Number

V-265984

Documentable

False

Rule Version

F5BI-DN-300015

Severity Override Guidance

This is only applicable if DNS recursion is being performed by the BIG-IP AND a custom root hint list must be defined.

From the BIG-IP GUI:
1. DNS.
2. Zones.
3. ZoneRunner.
4. Zone List.
5. Verify there is no Zone Name called ".".
6. If a "." Zone Name exists, log in to the BIG-IP CLI and run the following commands:
cat /var/named/config/namedb/db.external.named.root.
7. Verify valid root name servers are configured.

If the BIG-IP appliance is not configured to use valid root name servers in the local root zone file, this is a finding.

Check Content Reference

M

Target Key

5638