Ensure Avahi Server is not enabled

MediumLevel 1Automatedlinux

Description

Avahi is a free zeroconf implementation, including a system for multicast DNS/DNS-SD service discovery. Avahi allows programs to publish and discover services and hosts running on a local network with no specific configuration. For example, a user can plug a computer into a network and Avahi automatically finds printers to print to, files to look at and people to talk to, as well as network services running on the machine.

How it is checked

Audit method: Shell command

shell

alt0() { command -v systemctl >/dev/null 2>&1 || { echo "step1: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-enabled avahi-daemon.service' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- disabled || { echo step1: missing disabled; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step2: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl status avahi-daemon' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Active: inactive (dead)' || { echo step2: missing 'Active: inactive (dead)'; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step3: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl status avahi-daemon.socket' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Active: inactive (dead)' || { echo step3: missing 'Active: inactive (dead)'; return 1; }; }; if alt0; then echo compliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Run the following command to disable avahi-daemon : # systemctl disable avahi-daemon # systemctl stop avahi-daemon.socket # systemctl disable avahi-daemon.socket

Properties

Operating systems: alinux-2
Tags: cis-convertedlinux
Reference: CIS Aliyun Linux 2 Benchmark v1.0.0 ARCHIVE - 2.1.3

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target linux