From Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide
Part of SRG-APP-000394-DNS-000049
Associated with: CCI-001958
Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Device authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.
Authenticity of zone transfers within Windows AD integrated zones is accomplished by AD replication.
For zones which are completely AD-integrated, this check is not a finding.
For authenticity of zone transfers between non-AD-integrated zones, DNSSEC must be implemented.
Validate this check from the Windows 2012 DNS server being configured/reviewed.
Log on to the Windows 2012 DNS server using the account designated as Administrator or DNS Administrator.
Determine a valid host in the zone.
Open the Windows PowerShell prompt on the Windows 2012 DNS server being configured/reviewed.
Issue the following command:
(Replace www.zonename.mil with a FQDN of a valid host in the zone being validated. Replace ###.###.###.### with the FQDN or IP address of the Windows 2012 DNS Server hosting the signed zone.)
resolve-dnsname www.zonename.mil -server ###.###.###.### -dnssecok
Sign, or re-sign, the hosted zone(s) on the DNS server being validated. Log on to the DNS server using the account designated as Administrator or DNS Administrator. If not automatically started, initialize the Server Manager window by clicking its icon from the bottom left corner of the screen. Once the Server Manager window is initialized, from the left pane, click to select the DNS category. From the right pane, under the SERVERS section, right-click the DNS server. From the context menu that appears, click DNS Manager. In the DNS Manager console tree on the DNS server being validated, navigate to Forward Lookup Zones. Right-click the zone (repeat for each hosted zone), point to DNSSEC, and then click Sign the Zone, either using approved saved parameters or approved custom parameters.
Lavender hyperlinks in small type off to the right (of CSS
class id
, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle
or
Accept: application/rdf+xml
.
Powered by sagemincer