# Cis Bind V100 10 4

> Ensure Only the Necessary SELinux Booleans are Enabled (Automated)

- Skill: `cyberstrikeus/cis-bind-v100-10-4` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-bind-v100-10-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-bind-v100-10-4/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-bind-v100-10-4

---


# CIS 10.4 — Ensure Only the Necessary SELinux Booleans are Enabled

## Profile Applicability

- Caching Only Name Server Level 2
- Authoritative Name Server Level 2

## Description

SELinux booleans allow or disallow specific behaviors. There are two boolean variables specific to the ISC BIND DNS server:

- `named_tcp_bind_http_port` - Allow named to tcp bind http port
- `named_write_master_zones` - Allow named to write master zones

The `named_tcp_bind_http_port` would allow enabling the BIND statistics http channel which is not recommended. The `named_write_master_zones` allows BIND to update the master files, which is necessary when dynamic updates are performed, or the server is automatically maintaining DNSSEC digital signatures.

## Rationale

Enabling only the necessary named related booleans provides a defense in depth approach, that will deny actions that are not in use or expected.

## Impact

Not specified.

## Audit Procedure

Perform the following steps to determine if the recommended state is implemented:

Use `getsebool` to verify the `named_tcp_bind_http_port` boolean has a value of off.

```
# getsebool named_tcp_bind_http_port
named_tcp_bind_http_port --> off
```

The `named_write_master_zones` boolean is not audited as many BIND servers will require the boolean to be enabled.

## Remediation

Perform the following to implement the recommended state:

Disable the SELinux boolean using the `setsebool` command as shown below with the `-P` option to make the change persistent.

```
# setsebool -P named_tcp_bind_http_port off
```

## Default Value

The default value for `named_tcp_bind_http_port` is `off`.

## References

None listed in benchmark.

## CIS Controls

| Controls Version | Control                                                            | IG 1 | IG 2 | IG 3 |
| ---------------- | ------------------------------------------------------------------ | ---- | ---- | ---- |
| v7               | 9.2 Ensure Only Approved Ports, Protocols and Services Are Running | N    | Y    | Y    |

## MITRE ATT&CK Mappings

| Tactic          | Technique             |
| --------------- | --------------------- |
| Defense Evasion | T1562 Impair Defenses |

## Profile

- Level 2 - Authoritative Name Server
- Level 2 - Caching Only Name Server