Cis Bind V100 8 7
DevOps & Securitycis-bind-v100-8-7Cis Bind V100 8 7 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure Signing Keys are Unique (Automated)
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Bind/CIS_ISC_BIND_DNS_Server_9.11_Benchmark_v1.0.0/cis-bind-v100-8-7/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-bind-v100-8-7, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
CIS 8.7 — Ensure Signing Keys are Unique
Profile Applicability
- Authoritative Name Server Level 2
Description
Each zone should have a unique Zone Signing Keys (ZSK) and a unique Key Signing Keys (KSK) that is different from all other keys.
Rationale
The ZSK key typically has a shorter expiration date then the KSK, and should be unique from the KSK as well as keys used for other zones. If a private key is compromised, the damage is limited to unique key that was disclosed, rather the compromising multiple zones.
Impact
Not specified.
Audit Procedure
To verify each key is unique, and has unique zone usage, perform the following:
- The sample command below will extract the public keys from the key files and count the number of occurrences of each key value
# find $KEYDIR -name '*.key' | xargs grep -ho 'DNSKEY .*' | sort | uniq -c
The count occurrences preceding each key should be one in the output.
- To find the file names of duplicates key values, reuse the find command, but have the grep command report the file names for a given key value. For example:
# find $KEYDIR -name '*.key' | xargs grep -l ' <key value>
Remediation
To remediate a duplicate key, perform the following:
- Generate a new key to replace the duplicate key using dnssec-keygen and one of the recommended algorithms. An example command is shown below:
# dnssec-keygen -a ECDSAP256SHA256 example.org
- Implement a rollover period to phase out the duplicate key and replace it with the the newly generated key.
- Once the key is fully deleted from the active use, remove the file.
Default Value
Not specified.
References
None listed in benchmark.
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v7 | N/A | N | N | N |
MITRE ATT&CK Mappings
| Tactic | Technique |
|---|---|
| Credential Access | T1552 Unsecured Credentials |
Profile
- Level 2 - Authoritative Name Server