Ensure dhcp server services are not in use

MoyenneNiveau 1Automatiséelinux

Description

The Dynamic Host Configuration Protocol (DHCP) is a service that allows machines to be dynamically assigned IP addresses. There are two versions of the DHCP protocol DHCPv4 and DHCPv6. At startup the server may be started for one or the other via the -4 or -6 arguments.

Méthode de vérification

Méthode d'audit: Commande shell

shell

alt0() { command -v rpm >/dev/null 2>&1 || { echo "step1: rpm not installed"; return 1; }; o=$(bash -c 'rpm -q dhcp-server' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'package dhcp-server is not installed' || { echo step1: missing 'package dhcp-server is not installed'; return 1; }; }; alt1() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step1: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-enabled dhcpd.service dhcpd6.service 2>/dev/null | grep '"'"'enabled'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step2: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-active dhcpd.service dhcpd6.service 2>/dev/null | grep '"'"'^active'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step2: $o" | head -c 300; return 1; }; }; if alt0 || alt1; then echo compliant; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Run the following commands to stop dhcpd.service and dhcpd6.service and remove dhcp-server package: # systemctl stop dhcpd.service dhcpd6.service # dnf remove dhcp-server - OR - - IF - the dhcp-server package is required as a dependency: Run the following commands to stop and mask dhcpd.service and dhcpd6.service: # systemctl stop dhcpd.service dhcpd6.service # systemctl mask dhcpd.service dhcpd6.service

Propriétés

Systèmes d'exploitation: rocky-8
Étiquettes: cis-convertedlinux
Référence: CIS Rocky Linux 8 Benchmark v3.0.0 - 2.1.4

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target linux