Home
Security Hardening
DISA Bind 9.x STIG V2R2

DISA Bind 9.x STIG V2R2

BIND-9X-001040 – The BIND 9.x server implementation must be configured with a channel to send audit records to a remote syslog – syslog
Details Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to...
BIND-9X-001004 – The host running a BIND 9.X implementation must implement a set of firewall rules that restrict traffic on the DNS interface – tcp
Details Configuring hosts that run a BIND 9.X implementation to only accept DNS traffic on a DNS interface allows a...
BIND-9X-001041 – The BIND 9.x server implementation must be configured with a channel to send audit records to a local file.
Details DNS software administrators require DNS transaction logs for a wide variety of reasons including troubleshooting, intrusion detection, and forensics....
BIND-9X-001004 – The host running a BIND 9.X implementation must implement a set of firewall rules that restrict traffic on the DNS interface – udp
Details Configuring hosts that run a BIND 9.X implementation to only accept DNS traffic on a DNS interface allows a...
BIND-9X-001042 – The BIND 9.x server implementation must maintain at least 3 file versions of the local log file.
Details DNS software administrators require DNS transaction logs for a wide variety of reasons including troubleshooting, intrusion detection, and forensics....
BIND-9X-001005 – The host running a BIND 9.x implementation must use a dedicated management interface in order to separate management traffic from DNS specific traffic.
Details Providing Out-Of-Band (OOB) management is the best first step in any management strategy. No production traffic resides on an...
BIND-9X-001050 – The BIND 9.x secondary name server must limit the number of zones requested from a single master name server.
Details Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name...
BIND-9X-001006 – The host running a BIND 9.x implementation must use an interface that is configured to process only DNS traffic.
Details Configuring hosts that run a BIND 9.X implementation to only accept DNS traffic on a DNS interface allows a...
BIND-9X-001010 – A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components, based on selectable event criteria, and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes – category
Details Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating...
BIND-9X-001010 – A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components, based on selectable event criteria, and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes – channel
Details Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating...

Prev Next

DISA Bind 9.x STIG V2R2

BIND-9X-001040 – The BIND 9.x server implementation must be configured with a channel to send audit records to a remote syslog – syslog

BIND-9X-001004 – The host running a BIND 9.X implementation must implement a set of firewall rules that restrict traffic on the DNS interface – tcp

BIND-9X-001041 – The BIND 9.x server implementation must be configured with a channel to send audit records to a local file.

BIND-9X-001004 – The host running a BIND 9.X implementation must implement a set of firewall rules that restrict traffic on the DNS interface – udp

BIND-9X-001042 – The BIND 9.x server implementation must maintain at least 3 file versions of the local log file.

BIND-9X-001005 – The host running a BIND 9.x implementation must use a dedicated management interface in order to separate management traffic from DNS specific traffic.

BIND-9X-001050 – The BIND 9.x secondary name server must limit the number of zones requested from a single master name server.

BIND-9X-001006 – The host running a BIND 9.x implementation must use an interface that is configured to process only DNS traffic.