| name | cis-bind-v100-9-6 |
| description | Ensure Signing Keys are Scheduled to be Replaced Periodically (Automated) |
| category | cis-bind |
| version | 1.0 |
| author | cyberstrike-official |
| tags | ["cis","bind","dns","isc-bind","bind9","operations","dnssec"] |
| cis_id | 9.6 |
| cis_benchmark | CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 |
| tech_stack | ["bind","isc-bind","dns","linux"] |
| cwe_ids | ["CWE-324"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
CIS 9.6 — Ensure Signing Keys are Scheduled to be Replaced Periodically
Profile Applicability
- Authoritative Name Server Level 2
Description
Implement a periodic key rollover process for both the Zone Signing Keys (ZSK) and the Key Signing Keys (KSK). The ZSK should be replaced within 2 years or less. The KSK should be replaced within 6 years or less. Keys are replaced by generating a new key before the existing key expires, and scheduling a rollover date when the new key will phase out and replace the old key.
Rationale
Cryptographic keys like passwords need to be periodically replaced. By using strong key algorithms and appropriately long bit lengths, the lifetime for keys can be longer than a generally recommended for passwords. Typically, the Zone Signing Keys are rolled over more frequently than the Key Signing Keys.
Impact
Not specified.
Audit Procedure
Perform the following steps to determine if the recommended state is implemented:
- Locate all of the ZSK key files for the name server by searching for the
256 key code using the following command.
# ZKEYS=$(find $KEYDIR -name '*.key' | xargs grep -l 'DNSKEY 256 3' )
- Check that the ZSK activation date is more recent then 2 years prior to the current date with the following commands. To automate the two year date calculation the -u option could be used for
dnssec-settime to report the date in seconds since the start of the UNIX epoch.
# for zk in $ZKEYS; do echo -n "$zk: "; dnssec-settime -pA $zk; done
./Kcisecurity.com.+013+45248.key: Activate: Mon Mar 2 16:35:58 2020
- Locate all of the KSK key files for the name server by searching for the
257 key code using the following command.
# KKEYS=$(find $KEYDIR -name '*.key' | xargs grep -l 'DNSKEY 257 3' )
- Check that the KSK Activation date is more recent than six years prior to the current date. With the following command.
# for kk in $KKEYS; do echo -n "$kk: "; dnssec-settime -pA $kk; done
./Kcisecurity.com.+013+45248.key: Activate: Mon Mar 2 16:35:58 2020
If all ZSK activation dates are less than two years prior, and the KSK activation dates are less than six years prior, than the server is compliant.
Remediation
To replace an aged key, perform the following:
- Generate a new key to replace the old key using
dnssec-keygen and one of the recommended algorithms. An example command is shown below:
