BIND 9 (TSCM Web Auto)

Overview

This document describes the integration process of the ISC Bind 9 ThreatSTOP DNS Firewall server running on TSCM.

Setup proceedure summary:

• Open a ThreatSTOP account if you have not already done so.
• Using the Portal, configure a new device - Manufacturer: ISC and Model: BIND 9 (TSCM)
• Run tsadmin add command to create the device. The device will automatically configure itself. (untouched Bind configuration files backed up to /opt/threatstop/etc/bind_stock_configs.tgz)
• Configure the client machines to be protected to use the ThreatSTOP DNS Firewall for address resolution.

Compatibility

Current Version

# To check current module version(s) run
ts-client$ tsadmin version --all
ts-bind v1.06

Supported Systems

Device Settings

You will need the following two sets of settings to complete the installation. You can retrieve the RPZ Zone name, Policy TSIG Key name, Policy TSIG Key secret and Device ID via the settings of the device in the Admin Portal.

ThreatSTOP Portal Device Settings

Prerequisites

System

The ThreatSTOP TSCM Bind DNS Firewall requires a system that meets at least these specifications.

• 2 GB of RAM
• 10 GB of disk space
• Time synchronized (NTP)

Connectivity

To retrieve its configuration and policy, and to upload log data, the machine needs the following connectivity:

• DNS over UDP (Internal Clients -> DNS Firewall Device)
  • Inbound UDP port 53 [or whatever port you specify]
• DNS over UDP (optional, but recommended for DNS notifications)
  • IP Range: 192.124.129.0/24
  • Inbound UDP port 53
• DNS over TCP
  • IP Range: 192.124.129.0/24
  • Outbound TCP port 53 or 5353
• DNS over TLS - Configuration service
  • Hostname: ts-ctp.threatstop.com
  • IP Range: 204.68.97.208/28
  • Outbound TCP port 5353
• HTTPS
  • Hostname: logs.threatstop.com
  • IP range: 204.68.99.208/28
  • Outbound TCP port 443
• NTP
  • Outbound UDP port 123

Setup instructions

The following steps will walk you through adding the ThreatSTOP TSCM Bind DNS Firewall device.

ThreatSTOP Portal setup

• If you want to use a custom DNS Firewall policy, please read DNS Firewall Policies
• Create a new Device Entry: Click on Devices and then on Add Device.
  • The Manufacturer is: ISC
  • The Model is: BIND 9 (TSCM)
  • TSCM Bind with Web Automation
• Select the DNS Firewall policy - either a pre-defined policy or a custom policy
• Note: It can take up to 30 minutes for a new device to become available after it is created in the Portal. Once the device is available, its IP address will be recognized in the output of the following command:

Adding ISC Bind Device - Web Automation

Adding the Bind device via web automation is the easiest method as all the settings are handled in the portal and sent down to the TSCM. After filling out the portal form you can just run the following command on the TSCM CLI to add the device.

$ tsadmin add --type auto --device_id=[Device ID] --auto_key=[Device Key]

You will be prompted for all device settings listed above. The TSCM device will create Bind configuration files with the supplied settings after the setup wizard completes.

Testing / Troubleshooting

You can test the RPZ policy is working correctly by verifying a known blocked address like bad.threatstop.com returns NXDOMAIN. Below is an example of running with the DNS Utility dig.

dig @[Bind Server IP or Hostname] bad.threatstop.com
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 5611
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 2

Below is an example using nslookup, found natively on Windows machines.

C:\Users> nslookup bad.threatstop.com [Bind Server IP or Hostname]
Server:     [Bind Server Hostname]
Address:    [Bind Server IP]#53

** server can't find bad.threatstop.com: NXDOMAIN

Looking up a non-restricted website like google.com should return its current IP. You can repeat this on any client using this device as a DNS server.

• Check that a log entry was added to /var/log/threatstop/devices/[device name]/syslog
• You can test connectivity to ThreatSTOP by running:

$ curl https://logs.threatstop.com/cgi-bin/validip.pl
Your IP address: <ip address>
Address is in the list of authorized hosts

You can verify the Bind configuration has no major syntax errors by running

sudo named-checkconf

Customizing your configuration

As of v1.05 we’ve added the ability for localized configuration. We’ve created three entry points where you can add configuration to extend the BIND configuration without directly modifying the configuration files we manage.

/etc/bind.local
├── local.logging.conf
├── local.named.conf
└── local.options.conf

• local.named.conf - This is where you would put any global settings, the root of the configuration such as view definitions.
• local.logging.conf - This is where you would add any logging configuration. anything you would normally add into the logging { ... } section.
• local.options.conf - This is where you add configuration options for named.conf.options, basically anything you need to add to the options { ... } section.

After making any change make sure you run named-check to verify your configuration file is read ok. In the example below we added a non-existent setting dnssec off; to the /etc/bind.local/local.options.conf and ran the named-checkconf application to see if it parses ok.

threatstop@tsclient:/etc$ named-checkconf /etc/bind/named.conf
/etc/bind.local/local.options.conf:1: unknown option 'dnssec'

Changelog

• Mon, 21 Dec 2020 09:09:00 (1.05-02) urgency=low
  • GS-2594 : Zone name update bugfix
• Fri, 30 Oct 2020 09:56:00 (1.05-01) urgency=low
  • GS-2502 : setLock bugfix
• Thu, 29 Oct 2020 11:56:00 (1.04-01) urgency=high
  • GS-2518 : mutex bugfix
• Thu, 21 May 2020 14:06:00 (1.03-01) urgency=low
  • GS-2404 : Added localized bind configs, fixed auto-config bug
• Fri, 17 Jan 2020 10:13:00 (1.02-01) urgency=low
  • GS-2187 : Reconfigure Support and update now forces zone xfer
  • GS-2088 : Package enhancements and logging adjustments for future OS support
• Thu, 18 Jul 2019 16:46:00 (1.01-02) urgency=low
  • GS-1979 : updating telemetry
  • GS-2088 : updating syslog source
• Fri, 05 Apr 2019 16:23:00 (1.01-01) urgency=low
  • GS-1958 : Maintenance release
• Wed, 20 Feb 2019 09:51:00 (1.00-04) urgency=low
  • GS-1932 : bind options and validation all done in device module
• Thu, 07 Feb 2019 09:34:00 (1.00-03) urgency=low
  • GS-1910 : disable listening on ipv6
• Fri, 01 Feb 2019 16:44:00 (1.00-02) urgency=low
  • GS-1910 : fixed upstream dns port template issue. bind ctp updates not propogating. bind rndc reconfig on ctp update
• Mon, 21 Jan 2019 16:03:00
  • GS-1881 : Updated writing ACL config

Additional Information

• DNS Firewall configuration
• Bind 9 Reference