Accenture MDR Quick Start Guide for Bind DNS

This quick start guide will help Accenture MDR customers configure Bind DNS to send logs to the Log Collection Platform (LCP).

This quick start guide includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture Security Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found at Accenture Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table1-1: Port requirements for LCP communication.

Configuring Bind DNS

1. Login into the BIND DNS Server with root credentials

2. Create the log directory:

   $ sudo mkdir -p /var/log/bind $ sudo chown bind /var/log/bind

3. Edit /etc/bind/named.conf.options

   $ sudo editor /etc/bind/named.conf.options

4. Now move to the bottom (end) of the file, and add the following logging section:

   logging { channel transfers { file "/var/log/bind/transfers" versions 3 size 10M; print-time yes; severity info; }; channel notify { file "/var/log/bind/notify" versions 3 size 10M; print-time yes; severity info; }; channel dnssec { file "/var/log/bind/dnssec" versions 3 size 10M; print-time yes; severity info; }; channel query { file "/var/log/bind/query" versions 5 size 10M; print-time yes; severity info; }; channel general { file "/var/log/bind/general" versions 3 size 10M; print-time yes; severity info; }; channel slog { syslog security; severity info; }; category xfer-out { transfers; slog; }; category xfer-in { transfers; slog; }; category notify { notify; }; category lame-servers { general; }; category config { general; }; category default { general; }; category security { general; slog; }; category dnssec { dnssec; }; category queries { query; }; };

5. Save and exit the file, and TEST that it works.

LCP Configuration Parameters

Table 1-2: Bind DNS event collector (Syslog - 3829) properties to be configured by MDR are shown in the table.