UNIX
Instruction: The reviewer must work with the SA to obtain the username and groupname of the DNS software administrator and the username running the named daemon process.
In the presence of the reviewer, the SA should enter the following command to obtain the owner of the named process:
ps –ef | grep named
There are different ways (i.e., password/group file, NIS+, etc.) to obtain the DNS software administrator’s username and groupname, the reviewer is to work with the SA to obtain this information based on the configuration of the site’s UNIX OS.
In the presence of the reviewer, the SA should enter the following command while in the directory containing the DNS configuration files:
ls –l /etc/named.conf
If the DNS configuration files have permissions that allow write access to anyone beyond the DNS software administrator or the DNS software administrator then this is a finding.
Windows
For ISC BIND:
Instruction: The reviewer must work with the SA to obtain the username and groupname of the DNS software administrator and the owner of the named.exe or dns.exe or dns.exe program.
In the presence of the reviewer, the SA should right-click on the named.exe or dns.exe file and select Properties | Security tab | Advanced | Owner tab.
The reviewer should ask the SA for the location of the ISC BIND named.conf/zone files. For each DNS configuration file, right-click on the file and select Properties | Security tab.
If the DNS configuration files have permissions that allow write access to anyone beyond the DNS software administrator then this is a finding.
For Windows DNS:
Open the DNS management console and expand the Forward Lookup Zones. Right click on each zone and select Properties. Select the Security tab.
In order to accommodate Secure Dynamic Updates the "Authenticated Users" group must have Create/Delete Child objects permission.
If the DNS configuration files have permissions that allow write access to anyone beyond the DNS software administrator or permissions other than those needed to accommodate Secure Dynamic Updates, then this is a finding.