Home
Security Hardening
DISA Bind 9.x STIG V2R2

DISA Bind 9.x STIG V2R2

BIND-9X-001060 – A BIND 9.x caching name server must implement DNSSEC validation to check all DNS queries for invalid input – dnssec-validation
Details A common vulnerability of applications is unpredictable behavior when invalid inputs are received. This requirement guards against adverse or...
BIND-9X-001054 – A BIND 9.x server implementation must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks – recursion
Details A DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization...
BIND-9X-001054 – A BIND 9.x server implementation must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks – zone allow-query
Details A DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization...
BIND-9X-001055 – A BIND 9.x server implementation must prohibit recursion on authoritative name servers – allow-recursion
Details A potential vulnerability of DNS is that an attacker can poison a name server’s cache by sending queries that...
BIND-9X-001080 – A BIND 9.x implementation configured as a caching name server must restrict recursive queries to only the IP addresses and IP address ranges of known supported clients – allow-recursion
Details Any host that can query a resolving name server has the potential to poison the servers name cache or...
BIND-9X-001100 – The BIND 9.x server implementation must uniquely identify and authenticate the other DNS server before responding to a server-to-server transaction, zone transfer and/or dynamic update request using cryptographically based bidirectional authentication to protect the integrity of the information in transit – allow-transfer none
Details Server-to-server (zone transfer) transactions are provided by TSIG, which enforces mutual server authentication using a key that is unique...
BIND-9X-001100 – The BIND 9.x server implementation must uniquely identify and authenticate the other DNS server before responding to a server-to-server transaction, zone transfer and/or dynamic update request using cryptographically based bidirectional authentication to protect the integrity of the information in transit – master allow-transfer
Details Server-to-server (zone transfer) transactions are provided by TSIG, which enforces mutual server authentication using a key that is unique...
BIND-9X-001100 – The BIND 9.x server implementation must uniquely identify and authenticate the other DNS server before responding to a server-to-server transaction, zone transfer and/or dynamic update request using cryptographically based bidirectional authentication to protect the integrity of the information in transit – secondary keys
Details Server-to-server (zone transfer) transactions are provided by TSIG, which enforces mutual server authentication using a key that is unique...
BIND-9X-001060 – A BIND 9.x caching name server must implement DNSSEC validation to check all DNS queries for invalid input – managed-keys
Details A common vulnerability of applications is unpredictable behavior when invalid inputs are received. This requirement guards against adverse or...
BIND-9X-001070 – A BIND 9.x master name server must limit the number of concurrent zone transfers between authorized secondary name servers.
Details Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name...

Prev Next

DISA Bind 9.x STIG V2R2

BIND-9X-001060 – A BIND 9.x caching name server must implement DNSSEC validation to check all DNS queries for invalid input – dnssec-validation

BIND-9X-001054 – A BIND 9.x server implementation must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks – recursion

BIND-9X-001054 – A BIND 9.x server implementation must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks – zone allow-query

BIND-9X-001055 – A BIND 9.x server implementation must prohibit recursion on authoritative name servers – allow-recursion

BIND-9X-001080 – A BIND 9.x implementation configured as a caching name server must restrict recursive queries to only the IP addresses and IP address ranges of known supported clients – allow-recursion

BIND-9X-001060 – A BIND 9.x caching name server must implement DNSSEC validation to check all DNS queries for invalid input – managed-keys

BIND-9X-001070 – A BIND 9.x master name server must limit the number of concurrent zone transfers between authorized secondary name servers.