Rotate your device back to portrait to use STIG Vault.
The Windows DNS (V4 R1) has 29 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.
Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Rule Text
Discussion Text
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.
UNIX
Instruction: The reviewer must work with the SA to obtain the user name running the named process.
In the presence of the reviewer, the SA should enter the following command to obtain the owner of the named process:
ps –ef | grep named
The location to the encryption keys can be found by examining the keys directive in the /etc/named.conf file. In the presence of the reviewer, the SA should enter the following command while in the directory containing the DNS encryption keys:
ls –la ‘encryption_key_file’
If the DNS encryption key files have permissions weaker than 640, then this is a finding.
Windows with BIND
Instruction: The reviewer must work with the SA to obtain the owner of the named.exe.
In the presence of the reviewer, the SA should right-click on the named.exe file and select Properties | Security tab | Advanced | Owner tab.
For each DNS encryption key file listed in c:\named\etc\named.conf keys directive , right-click on the file and select Properties | Security tab.
If the DNS encryption key files have permissions that allow read access to anyone beyond the owner of the named.exe, then this is a finding.
The SA should modify permissions of the files containing DNS encryption keys so that only the DNS software process ID (PID) has read access to these files.