# Cis Bind9 V301 8 4

> Disable the HTTP Statistics Server (Scored)

- Skill: `cyberstrikeus/cis-bind9-v301-8-4` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-bind9-v301-8-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-bind9-v301-8-4/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-bind9-v301-8-4

---


# CIS 8.4 — Disable the HTTP Statistics Server

## Profile Applicability

- Level 1 - Authoritative Name Server
- Level 1 - Caching Only Name Server

## Description

Starting in BIND 9.5.0 there was a new statistics web server included, that is a useful debugging tool in a non-production environment. The HTTP server provides data in XML format about the condition of a BIND 9 server. The statistics server provides the same statistics that are available to the statistics-file dump. This server should be left disabled.

## Rationale

A production name server should not have additional, unnecessary services running, as the additional services increases the risk of vulnerabilities.

## Impact

None noted.

## Audit Procedure

Verify that there is NOT a statistics channel statement:

```bash
# grep statistics-channel $CONFIG_FILES
```

No output is expected and confirms that the HTTP service is not enabled.

## Remediation

Remove the `statistics-channel` option from the configuration file.

## Default Value

The HTTP server is disabled by default.

## References

None listed.

## CIS Controls

| Controls Version | Control                                         | IG 1 | IG 2 | IG 3 |
| ---------------- | ----------------------------------------------- | ---- | ---- | ---- |
| v6               | 9.1 - Limit Open Ports, Protocols, and Services | Y    | Y    | Y    |

## MITRE ATT&CK Mappings

| Tactic         | Technique                              |
| -------------- | -------------------------------------- |
| Reconnaissance | T1592 - Gather Victim Host Information |
| Discovery      | T1046 - Network Service Discovery      |

## Profile

- Level 1 - Authoritative Name Server
- Level 1 - Caching Only Name Server