STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

The BIND 9.x server implementation must be configured with a channel to send audit records to at least two remote syslogs.

DISA Rule

SV-272432r1123950_rule

Vulnerability Number

V-272432

Group Title

SRG-APP-000125-DNS-000012

Rule Version

BIND-9X-001910

Severity

CAT I

CCI(s)

• CCI-001348 - Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component that the system or component being audited.

Weight

10

Fix Recommendation

Configure the "logging" statement to send audit logs to the syslog daemons.

logging {
channel <syslog_channel> {
syslog <syslog_facility>;
};
category <category_name> { <syslog_channel>; };
};

logging {
channel <syslog_channel> {
syslog <syslog_facility>;
};
category <category_name> { <syslog_channel>; };
};

Note: It is recommended to use a local syslog facility (i.e., local0 -7) when configuring the syslog channel.

Restart the BIND 9.x process.

Check Contents

Verify that the BIND 9.x server is configured to send audit logs to at least two syslog servers.

Note: syslog and local file channel must be defined for every defined category.

Inspect the "named.conf" file for the following:

logging {
channel <syslog_channel> {
syslog <syslog_facility>;
};

category <category_name> { <syslog_channel>; };

logging {
channel <syslog_channel> {
syslog <syslog_facility>;
};

category <category_name> { <syslog_channel>; };

If a logging channel is not defined for each syslog, this is a finding.

If a category is not defined to send messages to the syslog channels, this is a finding.

Vulnerability Number

V-272432

Documentable

False

Rule Version

BIND-9X-001910

Severity Override Guidance

Verify that the BIND 9.x server is configured to send audit logs to at least two syslog servers.

Note: syslog and local file channel must be defined for every defined category.

Inspect the "named.conf" file for the following:

logging {
channel <syslog_channel> {
syslog <syslog_facility>;
};

category <category_name> { <syslog_channel>; };

logging {
channel <syslog_channel> {
syslog <syslog_facility>;
};

category <category_name> { <syslog_channel>; };

If a logging channel is not defined for each syslog, this is a finding.

If a category is not defined to send messages to the syslog channels, this is a finding.

Check Content Reference

M

Target Key

5687