V-248634

Discussion

To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.

Check Content

Determine whether the system is using local or DNS name resolution with the following command: 
 
$ sudo grep hosts /etc/nsswitch.conf 
 
hosts: files dns 
 
If the DNS entry is missing from the host's line in the "/etc/nsswitch.conf" file, the "/etc/resolv.conf" file must be empty. 
 
Verify the "/etc/resolv.conf" file is empty with the following command: 
 
$ sudo ls -al /etc/resolv.conf 
 
-rw-r--r-- 1 root root 0 Aug 19 08:31 resolv.conf 
 
If local host authentication is being used and the "/etc/resolv.conf" file is not empty, this is a finding. 
 
If the DNS entry is found on the host's line of the "/etc/nsswitch.conf" file, verify the operating system is configured to use two or more name servers for DNS resolution. 
 
Determine the name servers used by the system with the following command: 
 
$ sudo grep nameserver /etc/resolv.conf 
 
nameserver 192.168.1.2 
nameserver 192.168.1.3 
 
If fewer than two lines are returned that are not commented out, this is a finding.