Accenture MDR Quick Start Guide for Bind DNS

This quick start guide will help Accenture MDR customers configure Bind DNS to send logs to the Log Collection Platform (LCP).

This quick start guide includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring Bind DNS
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture Security Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found at Accenture Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table1-1: Port requirements for LCP communication.

Source

Destination

Port

Description

Bind DNS

LCP

514 (UDP) or

601 (TCP)

Default Port

Configuring Bind DNS

Below steps are validated on Ubuntu 24.04.1 LTS.

Login to the BIND DNS Server with root credentials.
Edit /etc/bind/named.conf.options
vim /etc/bind/named.conf.options
Add the following logging section at the end of the file:

Added support for all the possible Bind DNS logging types under the channels.
Any channels in the list can be removed if they are no longer needed for monitoring.
Redirected logs on Rsyslog Daemon with local6 Syslog Facility. Choose any syslog facility and ensure it is reflected in the Rsyslog configuration.

logging {
        channel transfers {
			print-severity yes;
    		print-category yes;
    		syslog local6;
        };
        channel notify {
			print-severity yes;
    		print-category yes;
    		syslog local6;
        };
        channel dnssec {
			print-severity yes;
    		print-category yes;
    		syslog local6;
        };
        channel query {
			print-severity yes;
    		print-category yes;
    		syslog local6;
        };
        channel general {
			print-severity yes;
    		print-category yes;
    		syslog local6;
        };
		channel slog {
			print-severity yes;
    		print-category yes;
    		syslog local6;
		};
        category xfer-out { transfers; slog; };
        category xfer-in { transfers; slog; };
        category notify { notify; };
        
        category lame-servers { general; };
        category config { general; };
        category default { general; };
        category security { general; slog; };
        category dnssec { dnssec; };
        category queries { query; };
};

Save and exit the file. Open /etc/rsyslog.d/50-default.conf.

vim /etc/rsyslog.d/50-default.conf

5. Append following configuration block at the end of this file.

local6.* @@FORWARDER_IP:601

6. Restart named and rsyslog service.

systemctl restart named.service rsyslog.service

LCP Configuration Parameters

Table 1-2: Bind DNS event collector (Syslog - 3829) properties to be configured by MDR are shown in the table.

Information	Default Value	Description
Protocol	UDP	The default Protocol for syslog. Bind DNS will forward logs to LCP using UDP & TCP protocol.
IP Addresses	Bind DNS Interface IP Address	Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ).
Signatures	named[,]: DHCPACK,]: DHCPDECLINE,]: DHCPDISCOVER,]: DHCPEXPIRE,]: DHCPINFORM,]: DHCPNAK,]: DHCPOFFER,]: DHCPRELEASE,]: DHCPREQUEST,unbound[, nsd[, dhcpd[	MDR recommended signatures processed by the Bind DNS event collector.
Port Number	514	The default port for syslog. The LCP can also accept logs from any port. Note: The LCP can be configured to listen on a non-standard port, please advise the MDR onboarding team if this is a requirement.