STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

In the event of an error when validating the binding of other DNS servers' identity to the BIND 9.x information, when anomalies in the operation of the signed zone transfers are discovered, for the success and failure of start and stop of the name server service or daemon, and for the success and failure of all name server events, a BIND 9.x server implementation must generate a log entry.

DISA Rule

SV-272418r1156948_rule

Vulnerability Number

V-272418

Group Title

SRG-APP-000350-DNS-000044

Rule Version

BIND-9X-001660

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-001906 - Perform organization-defined actions in the event of an error when validating the binding of the information producer identity to the information.
• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-002702 - Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.

Weight

10

Fix Recommendation

Edit the "named.conf" file.

Add the "severity" sub-statement to the "channel" statement.

Configure the "severity" sub-statement to "info".

Restart the BIND 9.x process.

Check Contents

Verify the name server is configured to log error messages with a severity of "info":

Inspect the "named.conf" file for the following:

logging {
channel channel_name {
severity info;
};

If the "severity" sub-statement is not set to "info", this is a finding.

Note: Setting the "severity" sub-statement to "info" will log all messages for the following severity levels: Critical, Error, Warning, Notice, and Info.

Vulnerability Number

V-272418

Documentable

False

Rule Version

BIND-9X-001660

Severity Override Guidance

Verify the name server is configured to log error messages with a severity of "info":

Inspect the "named.conf" file for the following:

logging {
channel channel_name {
severity info;
};

If the "severity" sub-statement is not set to "info", this is a finding.

Note: Setting the "severity" sub-statement to "info" will log all messages for the following severity levels: Critical, Error, Warning, Notice, and Info.

Check Content Reference

M

Target Key

5687