Home
Security Hardening
DISA Bind 9.x STIG V2R2

DISA Bind 9.x STIG V2R2

BIND-9X-001058 – The secondary name servers in a BIND 9.x implementation must be configured to initiate zone update notifications to other authoritative zone name servers – options notify
Details It is important to maintain the integrity of a zone file. The serial number of the SOA record is...
BIND-9X-001058 – The secondary name servers in a BIND 9.x implementation must be configured to initiate zone update notifications to other authoritative zone name servers – zone allow-notify
Details It is important to maintain the integrity of a zone file. The serial number of the SOA record is...
BIND-9X-001058 – The secondary name servers in a BIND 9.x implementation must be configured to initiate zone update notifications to other authoritative zone name servers – zone notify explicit
Details It is important to maintain the integrity of a zone file. The serial number of the SOA record is...
BIND-9X-001051 – The BIND 9.x secondary name server must limit the total number of zones the name server can request at any one time.
Details Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name...
BIND-9X-001059 – On the BIND 9.x server the platform on which the name server software is hosted must be configured to send outgoing DNS messages from a random port – listen-on
Details Hosts that run the name server software should not provide any other services and therefore should be configured to...
BIND-9X-001052 – The BIND 9.x server implementation must limit the number of concurrent session client connections to the number of allowed dynamic update clients.
Details Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name...
BIND-9X-001059 – On the BIND 9.x server the platform on which the name server software is hosted must be configured to send outgoing DNS messages from a random port – listen-on-v6
Details Hosts that run the name server software should not provide any other services and therefore should be configured to...
BIND-9X-001053 – The BIND 9.x server implementation must be configured to use only approved ports and protocols.
Details In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data...
BIND-9X-001060 – A BIND 9.x caching name server must implement DNSSEC validation to check all DNS queries for invalid input – dnssec-enable
Details A common vulnerability of applications is unpredictable behavior when invalid inputs are received. This requirement guards against adverse or...
BIND-9X-001054 – A BIND 9.x server implementation must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks – options allow-query
Details A DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization...

Prev Next

DISA Bind 9.x STIG V2R2

BIND-9X-001058 – The secondary name servers in a BIND 9.x implementation must be configured to initiate zone update notifications to other authoritative zone name servers – options notify

BIND-9X-001058 – The secondary name servers in a BIND 9.x implementation must be configured to initiate zone update notifications to other authoritative zone name servers – zone allow-notify

BIND-9X-001058 – The secondary name servers in a BIND 9.x implementation must be configured to initiate zone update notifications to other authoritative zone name servers – zone notify explicit

BIND-9X-001051 – The BIND 9.x secondary name server must limit the total number of zones the name server can request at any one time.

BIND-9X-001059 – On the BIND 9.x server the platform on which the name server software is hosted must be configured to send outgoing DNS messages from a random port – listen-on

BIND-9X-001052 – The BIND 9.x server implementation must limit the number of concurrent session client connections to the number of allowed dynamic update clients.

BIND-9X-001059 – On the BIND 9.x server the platform on which the name server software is hosted must be configured to send outgoing DNS messages from a random port – listen-on-v6

BIND-9X-001053 – The BIND 9.x server implementation must be configured to use only approved ports and protocols.

BIND-9X-001060 – A BIND 9.x caching name server must implement DNSSEC validation to check all DNS queries for invalid input – dnssec-enable

BIND-9X-001054 – A BIND 9.x server implementation must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks – options allow-query