The Windows DNS Server must use an approved DOD PKI certificate authority.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259392	WDNS-22-000064	SV-259392r945332_rule		Medium

Description
Untrusted certificate authorities (CA) can issue certificates, but the certificates may be issued by organizations or individuals that seek to compromise DOD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DOD-approved CA, trust of this CA has not been established. The DOD will only accept PKI certificates obtained from a DOD-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of SSL/TLS certificates. TSIG and SIG(0) are not configurable in Windows DNS Server. To meet the requirement for authentication between Windows DNS Servers, IPsec must be implemented between the Windows DNS Servers. Note: If multiple certificates from the same CA are present on the DNS server, IPsec authentication might fail due to an incorrect certificate being chosen. For this purpose, an Active Directory Certificate Services (AD CS) role must be installed and configured as an Enterprise certificate authority (CA). Refer to the Microsoft Windows Server DNS Overview.pdf for references on deploying certificates for this procedure.

Description

Untrusted certificate authorities (CA) can issue certificates, but the certificates may be issued by organizations or individuals that seek to compromise DOD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DOD-approved CA, trust of this CA has not been established. The DOD will only accept PKI certificates obtained from a DOD-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of SSL/TLS certificates. TSIG and SIG(0) are not configurable in Windows DNS Server. To meet the requirement for authentication between Windows DNS Servers, IPsec must be implemented between the Windows DNS Servers. Note: If multiple certificates from the same CA are present on the DNS server, IPsec authentication might fail due to an incorrect certificate being chosen. For this purpose, an Active Directory Certificate Services (AD CS) role must be installed and configured as an Enterprise certificate authority (CA). Refer to the Microsoft Windows Server DNS Overview.pdf for references on deploying certificates for this procedure.

STIG	Date
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide	2024-01-09

Details

Check Text ( C-63131r945330_chk )
Note: This requirement applies to any Windows DNS Servers that host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too. This requirement is not applicable to servers with only a caching role. If the Windows DNS Servers host only AD-integrated zones, this requirement is not applicable. Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. Press the Windows key + R and execute "gpme.msc" to open the Group Policy Management feature. In the "Browse for Group Policy Object" dialog box, double-click "Domain Controllers.domain.com". Click "Default Domain Controllers Policy" and click "OK". In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP. Click "Connection Security Rules". Consult with the system administrator to determine which Rules meet the intent of DNSSEC server-to-server authentication. Double-click on each "Rule" to verify the following: For the "Authentication" tab, click on the "Customize..." button. On the "Authentication" tab, verify "Authentication mode:" is set to "Request authentication for inbound and outbound connections". Confirm the "Signing Algorithm" is set to "RSA (default)". Under "Method", verify the "Advanced:" radio button is selected. Click the "Customize" button. For "First authentication methods:", double-click on the entry. Verify the "Select the credential to use for first authentication:" has "Computer certificate from this certification authority (CA):" radio button selected. Review the certificate specified and verify the certificate used was generated by the internally managed server performing the AD CS role. If the certificate used does not meet the requirements, this is a finding.

Check Text ( C-63131r945330_chk )

Note: This requirement applies to any Windows DNS Servers that host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too.

This requirement is not applicable to servers with only a caching role.

If the Windows DNS Servers host only AD-integrated zones, this requirement is not applicable.

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "gpme.msc" to open the Group Policy Management feature.

In the "Browse for Group Policy Object" dialog box, double-click "Domain Controllers.domain.com".

Click "Default Domain Controllers Policy" and click "OK".

In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP.

Click "Connection Security Rules".

Consult with the system administrator to determine which Rules meet the intent of DNSSEC server-to-server authentication.

Double-click on each "Rule" to verify the following:

For the "Authentication" tab, click on the "Customize..." button.

On the "Authentication" tab, verify "Authentication mode:" is set to "Request authentication for inbound and outbound connections".

Confirm the "Signing Algorithm" is set to "RSA (default)".

Under "Method", verify the "Advanced:" radio button is selected. Click the "Customize" button.

For "First authentication methods:", double-click on the entry.

Verify the "Select the credential to use for first authentication:" has "Computer certificate from this certification authority (CA):" radio button selected.

Review the certificate specified and verify the certificate used was generated by the internally managed server performing the AD CS role.

If the certificate used does not meet the requirements, this is a finding.

Fix Text (F-63039r945331_fix)
Complete the following procedures twice for each pair of name servers. Create a rule for UDP connections and then create a rule for TCP connections. Refer to the Microsoft Windows Server DNS Overview.pdf for Microsoft links for this procedure. Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. Press the Windows key + R and execute "gpme.msc" to open the Group Policy Management feature. In the "Browse for Group Policy Object" dialog box, double-click "Domain Controllers.domain.com". Click "Default Domain Controllers Policy" and click "OK". In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP. Right-click "Connection Security Rules" and select "New". For "Rule Type", select the "Server-to-server" radio button and click "Next". For Endpoint 1 and Endpoint 2, select "These IP addresses:" and add the IP addresses of all DNS servers. Click "Next". For "Requirements", select "Request authentication for inbound and outbound connections" and click "Next". For "Authentication Method", select Computer certificate and from the "Signing Algorithm:" drop-down, select "RSA (default)". From the "Certificate store type:" drop-down, select "Root CA (default)". From the "CA name:", click "Browse" and select the certificate generated by the internally managed server performing the AD CS role. Click "Next". On "Profile", accept the default selections and click "Next". On "Name", enter a name applicable to the rule's function (i.e., DNSSEC UDP). Click "Finish".

Fix Text (F-63039r945331_fix)

Complete the following procedures twice for each pair of name servers.

Create a rule for UDP connections and then create a rule for TCP connections.

Refer to the Microsoft Windows Server DNS Overview.pdf for Microsoft links for this procedure.

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "gpme.msc" to open the Group Policy Management feature.

In the "Browse for Group Policy Object" dialog box, double-click "Domain Controllers.domain.com".

Click "Default Domain Controllers Policy" and click "OK".

In the console tree, open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security - LDAP.

Right-click "Connection Security Rules" and select "New".

For "Rule Type", select the "Server-to-server" radio button and click "Next".

For Endpoint 1 and Endpoint 2, select "These IP addresses:" and add the IP addresses of all DNS servers. Click "Next".

For "Requirements", select "Request authentication for inbound and outbound connections" and click "Next".

For "Authentication Method", select Computer certificate and from the "Signing Algorithm:" drop-down, select "RSA (default)".

From the "Certificate store type:" drop-down, select "Root CA (default)".

From the "CA name:", click "Browse" and select the certificate generated by the internally managed server performing the AD CS role. Click "Next".

On "Profile", accept the default selections and click "Next".

On "Name", enter a name applicable to the rule's function (i.e., DNSSEC UDP).

Click "Finish".