Detections
Analytics

WDNS-IA-000002 - The Windows 2012 DNS Server must uniquely identify the other DNS server before responding to a server-to-server transaction.

Information

Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. This applies to server-to-server (zone transfer) transactions only and is provided by TSIG/SIG(0), which enforces mutual server authentication using a key that is unique to each server pair (TSIG) or using PKI-based authentication (SIG(0)), thus uniquely identifying the other server.

TSIG and SIG(0) are not configurable in Windows 2012 DNS Server.

To meet the requirement for authentication between Windows DNS servers, IPsec will be implemented between the Windows DNS servers which host any non-AD-integrated zones.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Complete the following procedures twice for each pair of name servers.

First create a rule for TCP connections.

Refer to the U_Windows_Domain_Name_Service_2008_Overview.pdf for Microsoft links for this procedure.

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press Windows Key + R, execute gpme.msc to open the Group Policy Management feature.

In the Browse for 'Group Policy Object' dialog box, double-click 'Domain Controllers.domain.com'.

Click 'Default Domain Controllers Policy' and click 'OK'.

In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP.

Right-Click 'Connection Security Rules' and select 'New'.

For Rule Type, select the 'Server-to-server' radio button, click 'Next'.

For Endpoint 1 and Endpoint 2, select 'These IP addresses:' and add the IP addresses of all DNS servers, click 'Next'.

For Requirements, select 'Request authentication for inbound and outbound connections', click 'Next'.

For Authentication Method, select Computer certificate and from the 'Signing Algorithm:' drop-down, select 'RSA (default)'.

From the 'Certificate store type:' drop-down, select 'Root CA (default)'.

From the 'CA name:', click 'Browse' and select the certificate for the CA, click 'Next'.

On Profile, accept default selections, click 'Next'.

On Name, enter a name applicable to the rule's function, click 'Finish'.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_2012_Server_DNS_V2R1_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000778, Rule-ID|SV-215600r561297_rule, STIG-ID|WDNS-IA-000002, STIG-Legacy|SV-73063, STIG-Legacy|V-58633, Vuln-ID|V-215600

Plugin: Windows

Control ID: 6b2ccd5f608abf7264526d4ef50b39d5e4f688bdcde9ede1dfdc7f6eb68e5a79