# Cis Bind V100 8 4

> Restrict Access to Zone and Key Signing Keys (Automated)

- Skill: `cyberstrikeus/cis-bind-v100-8-4` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-bind-v100-8-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-bind-v100-8-4/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-bind-v100-8-4

---


# CIS 8.4 — Restrict Access to Zone and Key Signing Keys

## Profile Applicability

- Authoritative Name Server Level 2

## Description

The files and directories for Zone Signing Keys (ZSK) and Key Signing Keys (KSK) should be read-only by the named user, with no access to other.

## Rationale

The named daemon does not require write access to the key files or the directories, Implementing a minimal read-only access provides an additional layer of denfense, so that if the service was exploited, the exploit would not be able to modify signing keys. Likewise restricting read access to the keys will prevent inappropriate disclosure of the private keys.

## Impact

Not specified.

## Audit Procedure

Ensure the KEYDIR variable is set to the top directory or directories that contains all of the key files for all of the authoritative zones. Then perform the following:

```
find $KEYDIR -perm /027 -ls
```

Any files or directories that are not compliant will be listed in the output along with their permissions.

## Remediation

Perform the following:

```
chmod  -R g-w,o-rwX $KEYDIR
```

## Default Value

The BIND signing key files and directory do not exist by default.

## References

None listed in benchmark.

## CIS Controls

| Controls Version | Control                                               | IG 1 | IG 2 | IG 3 |
| ---------------- | ----------------------------------------------------- | ---- | ---- | ---- |
| v7               | 14.6 Protect Information through Access Control Lists | Y    | Y    | Y    |

## MITRE ATT&CK Mappings

| Tactic            | Technique                   |
| ----------------- | --------------------------- |
| Credential Access | T1552 Unsecured Credentials |

## Profile

- Level 2 - Authoritative Name Server