cis-bind9-v301-5-1

name	cis-bind9-v301-5-1
description	Securely Authenticate Zone Transfers (Scored)
category	cis-bind
version	3.0.1
author	cyberstrike-official
tags	["cis","bind","dns","isc-bind","bind9","zone-transfers"]
cis_id	5.1
cis_benchmark	CIS ISC BIND DNS Server 9.9 Benchmark v3.0.1
tech_stack	["bind","isc-bind","dns","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 5.1 — Securely Authenticate Zone Transfers

Profile Applicability

• Level 1 - Authoritative Name Server

Description

A zone transfer is a mechanism commonly used by DNS deployments to replicate zone information from master/primary servers to slave/secondary servers. Each pair of name servers participating in zone transfers should authenticate the requests and ensure the integrity of the responses by using a unique shared secret TSIG key. BIND can be configured to respond only to authenticated transfer requests by using the allow-transfer statement with a key statement, that restricts the transfers to servers that provide a MAC using the named key.

Rationale

A zone transfer is a popular information disclosure attack as it provides the entire list of resource records for a zone. There should be very few systems such as the slave name servers that should be authorized to perform a zone transfer for your domains. Authentication of transfer requests should not be made using only an IP address, since IP addresses can be spoofed, but rather by using TSIG keys.

Impact

None noted.

Audit Procedure

Perform the following:

• Search all of the included configuration files and zone files for the allow-transfer option.

grep -C 1 allow-transfer $CONFIG_FILES $ZONE_FILES

• If there are no allow-transfer statements found, then the configuration allows zone transfers, and is not compliant.

• If the only value in the address match list of all the allow-transfer statements is the value none, either with or without quotes, then the configuration is compliant. Examples output is shown below.

allow-transfer { none; };
allow-transfer {"none";};

• If all of the address list values of the allow-transfer statements have the keyword key followed by a name, then the configuration is compliant.

allow-transfer { key ns1-ns2.cisecurity.org.; key ns2-ns3.cisecurity.org.; };

• If the predefined address value of any appears in the allow-transfer statement, then the configuration is not compliant. If any of the address list values contains ACL names, IP addresses or network ranges, then the configuration is also not compliant.