cyberstrikeus CIS 8.4 — Disable the HTTP Statistics Server
Profile Applicability
- Level 1 - Authoritative Name Server
- Level 1 - Caching Only Name Server
Description
Starting in BIND 9.5.0 there was a new statistics web server included, that is a useful debugging tool in a non-production environment. The HTTP server provides data in XML format about the condition of a BIND 9 server. The statistics server provides the same statistics that are available to the statistics-file dump. This server should be left disabled.
Rationale
A production name server should not have additional, unnecessary services running, as the additional services increases the risk of vulnerabilities.
Impact
None noted.
Audit Procedure
Verify that there is NOT a statistics channel statement:
# grep statistics-channel $CONFIG_FILES
No output is expected and confirms that the HTTP service is not enabled.
Remediation
Remove the statistics-channel option from the configuration file.
Default Value
The HTTP server is disabled by default.
References
None listed.
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v6 | 9.1 - Limit Open Ports, Protocols, and Services | Y | Y | Y |
MITRE ATT&CK Mappings
| Tactic | Technique |
|---|---|
| Reconnaissance | T1592 - Gather Victim Host Information |
| Discovery | T1046 - Network Service Discovery |
Profile
- Level 1 - Authoritative Name Server
- Level 1 - Caching Only Name Server