STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components based on selectable event criteria and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes.

DISA Rule

SV-272371r1156965_rule

Vulnerability Number

V-272371

Group Title

SRG-APP-000089-DNS-000004

Rule Version

BIND-9X-001110

Severity

CAT II

CCI(s)

• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
• CCI-000133 - Ensure that audit records containing information that establishes the source of the event.
• CCI-000134 - Ensure that audit records containing information that establishes the outcome of the event.
• CCI-001294 - Alert organization-defined personnel or roles of failed security verification tests.
• CCI-001665 - Preserve organization-defined system state information in the event of a system failure.

Weight

10

Fix Recommendation

Configure the logging statement in the "named.conf" file:

logging {
channel <channel_name> {
file "<file_name>";
severity info;
print-time yes;
print-category yes;
print-severity yes;
};
category default { <channel_name>; };
};

Replace <channel_name> and <file_name> with names that distinctively identify the purpose of the channel and the log file.

Restart the BIND 9.x process.

Check Contents

Verify the name server is configured to generate audit records:

Inspect the "named.conf" file for the following:

logging {
channel channel_name {
severity info;
print-time yes;
print-category yes;
print-severity yes;
};
category default { channel_name; };
};

If there is no "logging" statement, this is a finding.

If the "logging" statement does not contain a "channel", this is a finding.

If the "logging" statement does not contain a "category" that uses a "channel", this is a finding.

Vulnerability Number

V-272371

Documentable

False

Rule Version

BIND-9X-001110

Severity Override Guidance

Verify the name server is configured to generate audit records:

Inspect the "named.conf" file for the following:

logging {
channel channel_name {
severity info;
print-time yes;
print-category yes;
print-severity yes;
};
category default { channel_name; };
};

If there is no "logging" statement, this is a finding.

If the "logging" statement does not contain a "channel", this is a finding.

If the "logging" statement does not contain a "category" that uses a "channel", this is a finding.

Check Content Reference

M

Target Key

5687