← Back to Infoblox NIOS 9.x Security Technical Implementation Guide

V-285229

CAT I (High)

The Infoblox Grid Master must be configured as a stealth (hidden) domain DNS service member to protect the Zone Signing Key (ZSK) and Key Signing Key (KSK) residing on it.

Rule ID

SV-285229r1258806_rule

STIG

Infoblox NIOS 9.x Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000213 CCI-000186

Discussion

The private keys in the KSK and ZSK key pairs must be protected from unauthorized access. If possible, the private keys should be stored offline (with respect to the internet-facing, DNSSEC-aware name server) in a physically secure, nonnetwork-accessible machine along with the zone file master copy. This strategy is not feasible in situations in which the DNSSEC-aware name server must support dynamic updates. To support dynamic update transactions, the DNSSEC-aware name server (which usually is a primary authoritative name server) must have both the zone file master copy and the private key corresponding to the zone-signing key (ZSK-private) online to immediately update the signatures for the updated RRsets. The private key corresponding to the key-signing key (KSK-private) can still be kept offline. Satisfies: SRG-APP-000033-DNS-000111, SRG-APP-000176-DNS-000094, SRG-APP-000176-DNS-000096, SRG-APP-000915-DNS-000112, SRG-APP-000516-DNS-000108

Check Content

Verify the Infoblox Grid Manager is configured to be in "Stealth" mode.

By default, KSK and ZSK private keys are stored on the Grid Manager within the Infoblox database. No clients should be permitted to use the Grid Manager DNS service.

1. Navigate to Data Management >> DNS >> Zones tab.
2. Click "Edit", then select the "Name Servers" tab to review each zone.
3. For systems with Name Server Groups, go to Data Management >> DNS >> Name Server Groups >> Edit Group (Toolbar menu). 
4. Verify that the Grid Manager is set to "Stealth".

If a Hardware Security Module (HSM) is configured and KSK and ZSK private keys are encrypted and stored on the HSM, this is not a finding.

If the Grid Manager is a listed name server and not marked "Stealth", this is a finding.

Fix Text

For each zone that is not in compliance:

1. Navigate to Data Management >> DNS >> Zones tab.
2. Select and edit the zone.
3. Select the "Name Servers" tab and modify the Grid Manager server by opening the edit dialog and selecting "Stealth".
4. When complete, click "Save & Close" to save the changes and exit the "Properties" screen.
5. Perform a service restart if necessary.

If using Name Server Groups:
1. Navigate to Data Management >> DNS >> Name Sever Groups tab. 
2. Select the Name Server Group and edit.
3. Select the Grid Manager and edit.
4. Check the box for "Stealth".
5. When complete, click "Save & Close" to save the changes and exit the "Properties" screen.
6. Perform a service restart if necessary.

For clients that do not support GSS-TSIG:
1. From the Infoblox GUI, navigate to Data Management >> DNS >> Members tab. 
2. Review each server with the DNS service enabled. Select each server and click "Edit". 
3. Select the Updates >> Basic tab. Verify that either a Named Access Control List (ACL) or Set of Access Control Entities (ACEs) are defined to limit client DDNS. 
4. When complete, click "Cancel" to exit the "Properties" screen. 

If "Enable GSS-TSIG authentication of clients" is disabled for clients supporting GSS-TSIG, or a Named ACL or Set of ACEs is not defined to limit DDNS for clients without GSS-TSIG support, this is a finding.