Cis Bind9 V301 2 6
DevOps & Securitycis-bind9-v301-2-6Cis Bind9 V301 2 6 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Set Group named or root for BIND Directories and Files (Automated)
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Bind/CIS_ISC_BIND_DNS_Server_9.9_Benchmark_v3.0.1/cis-bind9-v301-2-6/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-bind9-v301-2-6, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
CIS 2.6 — Set Group named or root for BIND Directories and Files
Profile Applicability
- Level 1 - Authoritative Name Server
- Level 1 - Caching Only Name Server
Description
All the BIND directories and files should have a group of either named or root.
Rationale
In general, the BIND directories and files default to a group of named, however some system files may have a group of root. Examples of system files include chroot'ed system device files. Either group root or named is accepted, as the intent is to prevent unexpected group ids, from getting inappropriate access to BIND files. Run time directories to which BIND will need write access should have a group of named, so that write access may be granted via the group permissions.
Impact
Not Applicable
Audit Procedure
Ensure that the BIND benchmark variables used below are set as described in the benchmark overview. Run the command below to ensure that all BIND directories and files have a group of either named or root.
# find $BIND_HOME $RUNDIR \! \( -group root -o -group named \) -ls
There should be no files listed in the output from the find command.
Remediation
Run the command below to change all BIND directories and files to the group named.
chgrp -R named $BIND_HOME $RUNDIR
Default Value
The default rpm install has all directories and files in the BIND home and the run time directory with a group of named.
References
Not Applicable
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v6 | 14.4 - Protect Information with Access Control Lists | Y | Y | Y |
MITRE ATT&CK Mappings
| Tactic | Technique |
|---|---|
| Defense Evasion | T1222 - File and Directory Permissions Modification |
| Persistence | T1546 - Event Triggered Execution |
Profile
- Level 1 - Authoritative Name Server
- Level 1 - Caching Only Name Server