documentation_complete: true


title: 'Configure BIND to use System Crypto Policy'

description: |-
    Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
    BIND is supported by crypto policy, but the BIND configuration may be
    set up to ignore it.

    To check that Crypto Policies settings are configured correctly, ensure that the <tt>/etc/named.conf</tt>
    includes the appropriate configuration:
    In the <tt>options</tt> section of <tt>/etc/named.conf</tt>, make sure that the following line
    is not commented out or superseded by later includes:
    <tt>include "/etc/crypto-policies/back-ends/bind.config";</tt>

rationale: |-
    Overriding the system crypto policy makes the behavior of the BIND service violate expectations,
    and makes system configuration more fragmented.

severity: high

identifiers:
    cce@rhcos4: CCE-82544-8
    cce@rhel8: CCE-80934-3
    cce@rhel9: CCE-83451-5
    cce@rhel10: CCE-86874-5

references:
    nerc-cip: CIP-003-8 R4.2,CIP-007-3 R5.1
    nist: SC-13,SC-12(2),SC-12(3)
    srg: SRG-OS-000423-GPOS-00187,SRG-OS-000426-GPOS-00190
    stigid@ol8: OL08-00-010020

ocil_clause: |-
    BIND is installed and the BIND config file doesn't contain the
    <pre>include "/etc/crypto-policies/back-ends/bind.config";</pre> directive

ocil: |-
    To verify that BIND uses the system crypto policy, check out that the BIND config file
    <pre>/etc/named.conf</pre> contains the <pre>include "/etc/crypto-policies/back-ends/bind.config";</pre>
    directive:
    <pre>$ sudo grep 'include "/etc/crypto-policies/back-ends/bind.config";' /etc/named.conf</pre>
    Verify that the directive is at the bottom of the <pre>options</pre> section of the config file.

fixtext: |-
    Configure BIND to use the system crypto policy.

    Add the following line to the "options" section in "/etc/named.conf":

    include "/etc/crypto-policies/back-ends/bind.config";

srg_requirement: '{{{ full_name }}} BIND crypto policy must use approved ciphers.'

platform: package[bind]
