STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

On the BIND 9.x server, the private key corresponding to the zone signing key (ZSK), stored on name servers accepting dynamic updates, must be group owned by named.

DISA Rule

SV-272391r1156960_rule

Vulnerability Number

V-272391

Group Title

SRG-APP-000516-DNS-000111

Rule Version

BIND-9X-001350

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Change the group ownership of the ZSK private key to the root group account.

# chgrp named <key_file>

Check Contents

Note: This check only verifies for ZSK key file ownership. Permissions for key files are required under BIND-9X-001132 and BIND-9X-001142.

For each signed zone file, identify the ZSK "key id" number:

# cat <signed_zone_file> | grep -i "zsk"
ZSK; alg = ECDSAP256SHA256; key id = 22335

Using the ZSK "key id", verify the private ZSK.

Kexample.com.+008+22335.private

Verify that the private ZSK is owned by "named":

# ls -l <ZSK_key_file>
-r------- 1 named named 1776 Jul 3 17:56 Kexample.com.+008+22335.private

If the key file is not group owned by named, this is a finding.

Vulnerability Number

V-272391

Documentable

False

Rule Version

BIND-9X-001350

Severity Override Guidance

Note: This check only verifies for ZSK key file ownership. Permissions for key files are required under BIND-9X-001132 and BIND-9X-001142.

For each signed zone file, identify the ZSK "key id" number:

# cat <signed_zone_file> | grep -i "zsk"
ZSK; alg = ECDSAP256SHA256; key id = 22335

Using the ZSK "key id", verify the private ZSK.

Kexample.com.+008+22335.private

Verify that the private ZSK is owned by "named":

# ls -l <ZSK_key_file>
-r------- 1 named named 1776 Jul 3 17:56 Kexample.com.+008+22335.private

If the key file is not group owned by named, this is a finding.

Check Content Reference

M

Target Key

5687