UCF STIG Viewer Logo

The Infoblox system must use a security policy that limits the propagation of access rights.


Overview

Finding ID Version Rule ID IA Controls Severity
V-233872 IDNS-8X-400014 SV-233872r621666_rule Medium
Description
Discretionary Access Control (DAC) is based on the premise that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquired as a consequence of creating the object or via specified ownership assignment. In a DNS implementation, DAC should be granted to a minimal number of individuals and objects because DNS does not interact directly with users and users do not store and share data with the DNS application directly. The primary objective of DNS authentication and access control is the integrity of DNS records; only authorized personnel must be able to create and modify resource records, and name servers should only accept updates from authoritative master servers for the relevant zones. Integrity is best assured through authentication and access control features within the name server software and the file system the name server resides on. To protect the zone files and configuration data, which should only be accessed by the name service or an administrator, access controls need to be implemented on files, and rights should not be easily propagated to other users. Lack of a stringent access control policy places the DNS infrastructure at risk to malicious persons and attackers, in addition to potential denial of service to network resources. DAC allows the owner to determine who will have access to objects they control. An example of DAC includes user-controlled file permissions. DAC models have the potential for the access controls to propagate without limit, resulting in unauthorized access to objects. When applications provide a DAC mechanism, the DNS implementation must be able to limit the propagation of those access rights.
STIG Date
Infoblox 8.x DNS Security Technical Implementation Guide 2021-01-11

Details

Check Text ( C-37057r611136_chk )
Infoblox NIOS uses a robust permission structure that provides for granular configuration of user access to the administrative interface. Review the Infoblox Overview document for more information on access control and inheritance, and the Administrator Guide for comprehensive information.

1. Navigate to Administration >> Administrators. Review the "Authentication Policy" tab, which will display the authentication methods and order.
2. Review the "Admins", "Groups", "Roles", and "Permissions" tabs to display the specific accounts, roles, and permissions.
3. Verify the local assignment policy against the configured accounts.

If an access policy limiting propagation of access rights is not configured, or the Infoblox system is not configured in accordance with local access policy, this is a finding.
Fix Text (F-37022r611137_fix)
1. Review the Infoblox Administrator Guide for comprehensive instructions if necessary.
2. Navigate to Administration >> Administrators tab.
3. Edit the "Admins", "Groups", "Roles", "Permissions", and "Authentication Policy" tabs and set to the desired permissions.