Detections
Analytics

2.1.5 Ensure dhcp server services are not in use

Information

The Dynamic Host Configuration Protocol (DHCP) is a service that allows machines to be dynamically assigned IP addresses. On Debian 12, the kea package provides DHCPv4 and DHCPv6 server services via kea-dhcp4-server.service, kea-dhcp6-server.service, and kea-dhcp-ddns-server.service.

Unless a system is specifically designated as a DHCP server, the kea package should be removed to reduce the potential attack surface. A rogue or misconfigured DHCP server can cause network disruption by assigning incorrect IP addresses, DNS servers, or default gateways to clients. If removal is not possible due to a package dependency, all associated services must be stopped and masked to prevent them from running.

Solution

Run the following commands to stop kea-dhcp-ddns-server.service kea-dhcp4-server.service kea-dhcp6-server.service and remove kea package:

# systemctl stop kea-dhcp-ddns-server.service kea-dhcp4-server.service kea-dhcp6-server.service
# apt remove kea

- OR -

- IF - the kea package is required as a dependency:

Run the following commands to stop and mask dhcpd.service and dhcpd6.service :

# systemctl stop kea-dhcp-ddns-server.service kea-dhcp4-server.service kea-dhcp6-server.service
# systemctl mask kea-dhcp-ddns-server.service kea-dhcp4-server.service kea-dhcp6-server.service

Impact:

There may be packages that depend on the kea package. Removing it will remove those dependent packages as well. Review any dependent packages before removal to confirm they are not required. - IF - a dependent package is required, stop and mask all three kea services rather than removing the package.

See Also

https://workbench.cisecurity.org/benchmarks/26893

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 37ac1443242870eae10913a4f900d8d837c72df85b53cb41af13cadf0d41f3d0