OpenControls Logo

STIG Viewer

STIGViewer Support

The TSIG keys used with the BIND 9.x implementation must be group owned by a privileged account.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-272378BIND-9X-001210SV-272378r1123864_ruleCCI-000186medium
Description
Incorrect ownership of a TSIG key file could allow an adversary to modify the file, thus defeating the security objective.
STIGDate
BIND 9.x Security Technical Implementation Guide2026-02-25

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-10.2PKI-Based Authentication
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (55) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-12Session Termination
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(4)Discretionary Access Control
1.00

+45 more (top 10 by confidence shown)

CCI1 mapping
CCI-000186
1.00

Details

Check Text (C-272378r1123864_chk)

With the assistance of the DNS administrator, identify all of the TSIG keys used by the BIND 9.x implementation. Identify the account that the "named" process is running as: # ps -ef | grep named named 3015 1 0 12:59 ? 00:00:00 /usr/sbin/named -u named -t /var/named/chroot With the assistance of the DNS administrator, determine the location of the TSIG keys used by the BIND 9.x implementation. # ls -al <TSIG_Key_Location> -rw-r-----. 1 root named 76 May 10 20:35 tsig-example.key If any of the TSIG keys are not group owned by the above account, this is a finding.

Fix Text (F-76335r1123446_fix)

Change the group ownership of the TSIG keys to the named process group. # chgrp <named_proccess_group> <TSIG_key_file>