Cis Bind V100 9 4
DevOps & Securitycis-bind-v100-9-4Cis Bind V100 9 4 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Disable the HTTP Statistics Server (Automated)
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Bind/CIS_ISC_BIND_DNS_Server_9.11_Benchmark_v1.0.0/cis-bind-v100-9-4/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-bind-v100-9-4, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
CIS 9.4 — Disable the HTTP Statistics Server
Profile Applicability
- Authoritative Name Server Level 1
- Caching Only Name Server Level 1
Description
Starting in BIND 9.5.0 there was a new statistics web server included, that is a useful debugging tool in a non-production environment. The HTTP server provide data in XML format about the condition of a BIND 9 server. The statistics server provides the same statistics that are available to the statistics-file dump. This server should be left disabled.
Rationale
A production name server should not have additional, unnecessary services running, as the additional services increases the risk of vulnerabilities.
Impact
Not specified.
Audit Procedure
Verify that there is NOT a statistics channel statement:
# grep statistics-channel $CONFIG_FILES
No output is expected and confirms that the HTTP service is not enabled.
Remediation
Remove the statistics-channel option from the configuration file.
Default Value
The HTTP server is disabled by default.
References
None listed in benchmark.
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v6 | 9.1 Limit Open Ports, Protocols, and Services | Y | Y | Y |
| v7 | 9.2 Ensure Only Approved Ports, Protocols and Services Are Running | N | Y | Y |
MITRE ATT&CK Mappings
| Tactic | Technique |
|---|---|
| Discovery | T1046 Network Service Discovery |
Profile
- Level 1 - Authoritative Name Server
- Level 1 - Caching Only Name Server