Ensure dhcp relay services are not in use

MédiaNível 1Automatizadaaix

Descrição

The dhcprd daemon listens for broadcast packets, receives them, and forwards them to the appropriate DHCP or BOOTP server. Unless a system is specifically set up to act as a DHCP relay server, it is recommended that the dhcpd fileset be removed to reduce the potential attack surface. Audit: the dhcprd start line in /etc/rc.tcpip must be commented out and the dhcprd subsystem must not be active.

Como é verificado

Método de auditoria: Comando shell

shell

command -v lssrc >/dev/null 2>&1 || exit 1; [ -r /etc/rc.tcpip ] || exit 1; out=$( { grep -E "^[[:blank:]]*start[[:blank:]]+/usr/(sbin|lib)/dhcprd([[:blank:]]|$)" /etc/rc.tcpip; lssrc -s dhcprd | awk 'NR>1 && $NF=="active"' ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Run the following command to remove the software: # /usr/sbin/installp -u bos.net.tcp.dhcpd bos.net.tcp.server - OR - - IF - the bos.net.tcp.dhcpd fileset is required as a dependency: Run the following script to stop and disable dhcprd #!/usr/bin/ksh DAEMONS="dhcprd" for l_daemon in $DAEMONS; do /usr/sbin/chrctcp -d $l_daemon /usr/bin/stopsrc -s $l_daemon done

Propriedades

Sistemas operacionais: Qualquer
Tags: aixnetwork
Referência: CIS IBM AIX 7 Benchmark v1.2.0 - 4.3.2.3 Ensure dhcp relay services are not in use

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target aix