Cis Bind V100 9 6

CIS 9.6 — Ensure Signing Keys are Scheduled to be Replaced Periodically

Profile Applicability

• Authoritative Name Server Level 2

Description

Implement a periodic key rollover process for both the Zone Signing Keys (ZSK) and the Key Signing Keys (KSK). The ZSK should be replaced within 2 years or less. The KSK should be replaced within 6 years or less. Keys are replaced by generating a new key before the existing key expires, and scheduling a rollover date when the new key will phase out and replace the old key.

Rationale

Cryptographic keys like passwords need to be periodically replaced. By using strong key algorithms and appropriately long bit lengths, the lifetime for keys can be longer than a generally recommended for passwords. Typically, the Zone Signing Keys are rolled over more frequently than the Key Signing Keys.

Impact

Not specified.

Audit Procedure

Perform the following steps to determine if the recommended state is implemented:

• Locate all of the ZSK key files for the name server by searching for the 256 key code using the following command.

# ZKEYS=$(find $KEYDIR -name '*.key' | xargs grep -l 'DNSKEY 256 3' )

• Check that the ZSK activation date is more recent then 2 years prior to the current date with the following commands. To automate the two year date calculation the -u option could be used for dnssec-settime to report the date in seconds since the start of the UNIX epoch.

# for zk in $ZKEYS; do echo -n "$zk:  "; dnssec-settime -pA $zk; done
./Kcisecurity.com.+013+45248.key:  Activate: Mon Mar  2 16:35:58 2020

• Locate all of the KSK key files for the name server by searching for the 257 key code using the following command.

# KKEYS=$(find $KEYDIR -name '*.key' | xargs grep -l 'DNSKEY 257 3' )

• Check that the KSK Activation date is more recent than six years prior to the current date. With the following command.

# for kk in $KKEYS; do echo -n "$kk:  "; dnssec-settime -pA $kk; done
./Kcisecurity.com.+013+45248.key:  Activate: Mon Mar  2 16:35:58 2020

If all ZSK activation dates are less than two years prior, and the KSK activation dates are less than six years prior, than the server is compliant.

Remediation

To replace an aged key, perform the following:

• Generate a new key to replace the old key using dnssec-keygen and one of the recommended algorithms. An example command is shown below:

# dnssec-keygen -a ED25519 example.org
# dnssec-keygen -a ED25519 -f KSK example.org

• Implement a rollover period to phase out the old key and replace it with the newly generated key. The older key should have dates set for the keys to be inactive and then deleted.

# dnssec-settime -I +30d -D +60d  Kexample.org.+013+46651.key

• Once the date for key deletion has passed, and the key is no longer included in the zone, then remove the key files.

Default Value

Signing key rollover is NOT implemented by default.

References

1. https://www.dnsinstitute.com/documentation/dnssec-guide/ch06s04.html
2. https://downloads.isc.org/isc/dnssec-guide/dnssec-guide.pdf
3. https://tools.ietf.org/html/rfc7583

CIS Controls

MITRE ATT&CK Mappings

Profile

• Level 2 - Authoritative Name Server