Detections
Analytics

4.3.2.4 Ensure dhcp server services are not in use

Information

The dhcpsd deamon is the DHCP server that serves addresses and configuration information to DHCP clients in the network.

Unless a system is specifically set up to act as a DHCP server, it is recommended that the dhcpd fileset be removed to reduce the potential attack surface.

Solution

Run the following command to remove the software:

# /usr/sbin/installp -u bos.net.tcp.dhcpd bos.net.tcp.server

- OR -

- IF - the bos.net.tcp.dhcpd fileset is required as a dependency:

Run the following script to stop and disable dhcpsd

#!/usr/bin/ksh
DAEMONS="dhcpsd"
for l_daemon in $DAEMONS;
do
 /usr/sbin/chrctcp -d $l_daemon
 /usr/bin/stopsrc -s $l_daemon
done

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CCI|CCI-000381, CSCv7|9.2, Rule-ID|SV-215405r958478_rule, Vuln-ID|V-215405

Plugin: Unix

Control ID: 56b4eeb84eeb119c6c37cf50c0c096a944f2d86ec155947e5ded4b22dfed9fe6