STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

A BIND 9.x server implementation must be running in a chroot(ed) directory structure.

DISA Rule

SV-272422r1137672_rule

Vulnerability Number

V-272422

Group Title

SRG-APP-000243-DNS-000034

Rule Version

BIND-9X-001720

Severity

CAT II

CCI(s)

• CCI-001090 - Prevent unauthorized and unintended information transfer via shared system resources.

Weight

10

Fix Recommendation

Configure the BIND 9.x server to operate in a chroot(ed) directory structure.

Check Contents

Verify that the directory structure where the primary BIND 9.x server configuration files are stored is running in a chroot(ed) environment or a containerized environment:

# ps -ef | grep named

named 3015 1 0 12:59 ? 00:00:00 /usr/sbin/named -u named -t /var/named/chroot

If the output does not contain "-t <chroot_path>" and the named process is not running in a container, this is a finding.

Vulnerability Number

V-272422

Documentable

False

Rule Version

BIND-9X-001720

Severity Override Guidance

Verify that the directory structure where the primary BIND 9.x server configuration files are stored is running in a chroot(ed) environment or a containerized environment:

# ps -ef | grep named

named 3015 1 0 12:59 ? 00:00:00 /usr/sbin/named -u named -t /var/named/chroot

If the output does not contain "-t <chroot_path>" and the named process is not running in a container, this is a finding.

Check Content Reference

M

Target Key

5687