Ensure dhcp server services are not in use

보통레벨 1자동linux

설명

The Dynamic Host Configuration Protocol (DHCP) is a service that allows machines to be dynamically assigned IP addresses. There are two versions of the DHCP protocol DHCPv4 and DHCPv6. At startup the server may be started for one or the other via the -4 or -6 arguments.

점검 방법

감사 방식: 셸 명령

shell

alt0() { command -v rpm >/dev/null 2>&1 || { echo "step1: rpm not installed"; return 1; }; o=$(bash -c 'rpm -q dhcp-server' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'package dhcp-server is not installed' || { echo step1: missing 'package dhcp-server is not installed'; return 1; }; }; alt1() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step1: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-enabled dhcpd.service dhcpd6.service 2>/dev/null | grep '"'"'enabled'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step2: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-active dhcpd.service dhcpd6.service 2>/dev/null | grep '"'"'^active'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step2: $o" | head -c 300; return 1; }; }; if alt0 || alt1; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Run the following commands to stop dhcpd.service and dhcpd6.service and remove dhcp-server package: # systemctl stop dhcpd.service dhcpd6.service # dnf remove dhcp-server - OR - - IF - the dhcp-server package is required as a dependency: Run the following commands to stop and mask dhcpd.service and dhcpd6.service: # systemctl stop dhcpd.service dhcpd6.service # systemctl mask dhcpd.service dhcpd6.service

속성

운영 체제: rocky-8
태그: cis-convertedlinux
참고 자료: CIS Rocky Linux 8 Benchmark v3.0.0 - 2.1.4

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target linux