Cis Bind9 V301 2 7
DevOps & Securitycis-bind9-v301-2-7Cis Bind9 V301 2 7 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Set Group and Other Permissions Read-Only for BIND Non-Runtime Directories (Automated)
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Bind/CIS_ISC_BIND_DNS_Server_9.9_Benchmark_v3.0.1/cis-bind9-v301-2-7/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-bind9-v301-2-7, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
CIS 2.7 — Set Group and Other Permissions Read-Only for BIND Non-Runtime Directories
Profile Applicability
- Level 1 - Authoritative Name Server
- Level 1 - Caching Only Name Server
Description
All the BIND directories except the run-time directories into which BIND will create files should have group and other permissions set to not be writable. No directories in the BIND_HOME or the RUNDIR should have other write permissions, even a chroot'ed tmp directory only needs to be writable by the named group.
Rationale
Restricting permissions on the directories provides defense in depth and will reduce the probability of unauthorized modifications to important files. If there was a BIND vulnerability that allowed code execution as the named user, then the code would not be able create or modify configuration files.
Impact
Not Applicable
Audit Procedure
Ensure the BIND_HOME and runtime directory variables are set as specified in the overview without a trailing slash on the directory name. Run the commands below to ensure that all BIND directories are read-only for other, and read-only for group except for the expected run time directories where the named service will create files.
# find $BIND_HOME -type d -perm /020 | egrep -vx \
$DYNDIR\|$SLAVEDIR\|$DATADIR\|$RUNDIR\|$LOGDIR\|$TMPDIR
# find $BIND_HOME $RUNDIR -type d -perm /002
There should be no files listed in the output from the find commands.
Remediation
Perform the following:
- Capture the output from the audit commands above into a file named
write-dirs.txt - Review the purpose for the identified directories and either delete them if the directory is not needed, or change the permissions of the directory to not be writable by group or other.
- The following command can be used to change the permissions of the directories that are appropriate.
xargs -a write-dirs.txt chmod go-w
Default Value
The default rpm install has all non-runtime directories without group or other write access.
References
Not Applicable
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v6 | 14.4 - Protect Information with Access Control Lists | Y | Y | Y |
MITRE ATT&CK Mappings
| Tactic | Technique |
|---|---|
| Defense Evasion | T1222 - File and Directory Permissions Modification |
| Persistence | T1546 - Event Triggered Execution |
Profile
- Level 1 - Authoritative Name Server
- Level 1 - Caching Only Name Server