6.1 Hide BIND Version String

Information

BIND includes a built-in zone, version.bind which may be queried to get the version of the name server. The version may be set to a value of none, to disable reporting of the version information.

Rationale:

Making detailed BIND version information easy to obtain remotely helps attackers automate and target their attacks. The information is not necessary for the health of the server, and should not be disclosed.

Solution

Add or modify the version option to have a value of none in the BIND global options, as shown below.

options {
version none;
. . .
}

Default Value:

Default value returns the current BIND detailed version.

See Also

https://workbench.cisecurity.org/files/1735

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-30(5), CSCv6|9

Plugin: Unix

Control ID: 866091881bbddfb4f499e2810a2db11f1cb2b070fe1744f621bbc6af960dfdaa