Detections
Analytics

4.3.2.2 Ensure dhcp client services are not in use

Information

The dhcpcd and dhcpcd6 daemons receive address and configuration information from the DHCP server for IPv4 and IPv6 respectively.

Unless a system is specifically expected to receive IP address and configuration via DHCP, it is recommended that the dhcp client fileset be removed to reduce the potential attack surface.

Solution

Run the following command to remove the software:

# /usr/sbin/installp -u bos.net.tcp.dhcp bos.net.tcp.client

- OR -

- IF - the bos.net.tcp.dhcp fileset is required as a dependency:

Run the following script to stop and disable dhcpcd and dhcpcd6

#!/usr/bin/ksh
DAEMONS="dhcpcd dhcpcd6"
for l_daemon in $DAEMONS;
do
 /usr/sbin/chrctcp -d $l_daemon
 /usr/bin/stopsrc -s $l_daemon
done

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CCI|CCI-000381, CSCv7|9.2, Rule-ID|SV-215355r958478_rule, Vuln-ID|V-215355

Plugin: Unix

Control ID: da207aefdf96cb62ab56423d3c2723cffd6beaf406329b0d02762b4a1c90f8a1