cis-bind-v100-8-8

name	cis-bind-v100-8-8
description	Ensure Zones are Signed with NSEC or NSEC3 (Automated)
category	cis-bind
version	1.0
author	cyberstrike-official
tags	["cis","bind","dns","isc-bind","bind9","dnssec"]
cis_id	8.8
cis_benchmark	CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0
tech_stack	["bind","isc-bind","dns","linux"]
cwe_ids	["CWE-345"]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 8.8 — Ensure Zones are Signed with NSEC or NSEC3

Profile Applicability

• Authoritative Name Server Level 2

Description

The NSEC records are used to prove that a name does not exist, by providing the name before it, and the name after it. NSEC3 records are similar, while using a hash to link records in order to make zone enumeration much more difficult. Either record type will securely validate a negative answer that a name does not exist.

Rationale

The DNSSEC RRSIG records allows verification of the integrity and authenticity of answers for names which exist. However when the authoritative name server answers that a name does not exist. The nonexistent answer is not signed, and cannot be securely signed. An attacker could take advantage of this by spoofing nonexistent name answers to prevent resolving legitimate names. The NSEC and NSEC3 records provide a means for a DNSSEC validating resolver to verify the authenticity of nonexistent answer.

Impact

Not specified.

Audit Procedure

To audit the authoritative name server, use the delv command on a independent DNSSEC validating resolver to query a nonexistent name of the authoritative name server. The response should be a "negative response, fully validated" similar to the following example.

$  delv @8.8.8.8 nosuch-name.isc.org
;; resolution failed: ncache nxdomain
; negative response, fully validated
; nosuch-name.isc.org. 3200171710 IN  \-ANY   ;-$NXDOMAIN
; isc.org. SOA ns-int.isc.org. hostmaster.isc.org. 2020031004 7200 3600
24796800
. . .

A non-compliant response will not contain the "fully validated" response. For example:

$ delv @8.8.8.8 nosuch-name.example.com
;;    validating example.com/SOA: no valid signature found
;;    validating example.com/NSEC: no valid signature found
;; resolution failed: ncache nxdomain
; negative response, unsigned answer
; nosuch-name.example.com. 3200171710 IN \-ANY ;-$NXDOMAIN
. . .

Remediation

An NSEC record and NSEC signatures are generated automatically by BIND for DNSSEC signed zones. If the audit fails, then verify that the zone has a valid signature and has delegated trust from the parent domain as in the previous recommendations "8.5 Ensure each Zone has a Valid Digital Signature" and "8.6 Ensure Full Digital Chain of Trust can be Validated" The signed zone file, or a zone transfer can also be checked for NSEC signatures. With a command such as:

$ dig @127.0.0.1 example.org AXFR | grep -w 'NSEC'
example.org.   86400   IN      NSEC    www.example.org. A NS SOA RRSIG NSEC DNSKEY TYPE65534
example.org.   86400   IN      RRSIG   NSEC 8 2 86400 20200325222408 20200224212408 4236
. . .

Converting NSEC signing to NSEC3 signing is helpful to prevent zone walking of the linked NSEC records which easily reveal all of the names in a zone. The NSEC3 algorithm creates a linked list of signed hash values, instead of names to prevent the simple disclosure of all names. The rndc signing command can be used to convert NSEC signing to NSEC3 signing. For example: