cis-bind-v100-1-3

name	cis-bind-v100-1-3
description	Dedicated Name Server Role (Automated)
category	cis-bind
version	1.0
author	cyberstrike-official
tags	["cis","bind","dns","isc-bind","bind9","planning-and-architecture"]
cis_id	1.3
cis_benchmark	CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0
tech_stack	["bind","isc-bind","dns","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 1.3 — Dedicated Name Server Role

Profile Applicability

• Authoritative Name Server Level 1
• Caching Only Name Server Level 1

Description

A name server may be an authoritative name server for one or more domains for which it is configured to provide information. An authoritative-only name server only answers queries on the domains for which it is configured, and will reject queries for other domains. A caching name server will answer queries any domain. The caching name server gets answers by sending recursive DNS queries to other name servers and then storing the answer in its cache to provide a quicker response to the next query for that name. A caching-only name server is not authoritative for any domain. The BIND DNS names server should be configured to be either a caching-only or an authoritative-only name server, but not both.

Rationale

DNS name servers are a foundational part of your network architecture and the security of other network services depend on their integrity. It is important to separate the roles of caching and authoritative name servers to minimize functionality and reduce risk for each server. Each name server role faces different threats in addition to direct attacks on the server. For example, the caching name server faces unique threats of malicious replies with bogus answers or over-sized answers intended to deny service. The authoritative name server is a critical part of the infrastructure should not be exposed to these additional attacks.

Impact

Not specified.

Audit Procedure

Authoritative-Only Name Server: To audit an authoritative name server, ensure it doesn't answer queries for other non-authoritative domain names. The following command may be run on a Linux system other than the name server to verify the query status is refused.

$ dig @<ip_address_of_nameserver> <non_authoritative_name> | grep status
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 52410

Alternatively, the BIND configuration file name.conf and all included configuration files may be searched for the allow-recursion statement. No configured occurrences other than localhost and local loopback should be found.

# grep allow-recursion $CONFIG_FILES
named.conf: allow-recursion { 127.0.0.1; };

Caching-Only Name Server: To audit a caching-only name server, send a query with the no recursion specified for a valid authoritative name in the organization.

$ dig +norecurse @<ip_address_of_nameserver> <authoritative_name> | grep status
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 12379