Title

Permissions on files containing DNS encryption keys are inadequate. (Cat II impact)

Discussion

Weak permissions could allow an intruder to view or modify DNS encryption key files. These keys should never be readable by Other or Everyone.

Check Content

UNIX Instruction: The reviewer must work with the SA to obtain the user name running the named process. In the presence of the reviewer, the SA should enter the following command to obtain the owner of the named process: ps –ef | grep named The location to the encryption keys can be found by examining the keys directive in the /etc/named.conf file. In the presence of the reviewer, the SA should enter the following command while in the directory containing the DNS encryption keys: ls –la ‘encryption_key_file’ If the DNS encryption key files have permissions weaker than 640, then this is a finding. Windows with BIND Instruction: The reviewer must work with the SA to obtain the owner of the named.exe. In the presence of the reviewer, the SA should right-click on the named.exe file and select Properties | Security tab | Advanced | Owner tab. For each DNS encryption key file listed in c:\named\etc\named.conf keys directive , right-click on the file and select Properties | Security tab. If the DNS encryption key files have permissions that allow read access to anyone beyond the owner of the named.exe, then this is a finding.

Fix Text

The SA should modify permissions of the files containing DNS encryption keys so that only the DNS software process ID (PID) has read access to these files.

Additional Identifiers

Rule ID: SV-4475r2_rule

Vulnerability ID: V-4475

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.