Minimize Served Information
An XCCDF Rule
Description
Edit /etc/dhcp/dhcpd.conf. Examine each address range section within the file, and ensure that the following options are not defined unless there is an operational need to provide this information via DHCP:
option domain-name option domain-name-servers option nis-domain option nis-servers option ntp-servers option routers option time-offset
warning alert: Warning
By default, the Red Hat Enterprise Linux client installation uses DHCP
to request much of the above information from the DHCP server. In particular,
domain-name, domain-name-servers, and routers are configured via DHCP. These
settings are typically necessary for proper network functionality, but are also
usually static across systems at a given site.
Rationale
Because the configuration information provided by the DHCP server could be maliciously provided to clients by a rogue DHCP server, the amount of information provided via DHCP should be minimized. Remove these definitions from the DHCP server configuration to ensure that legitimate clients do not unnecessarily rely on DHCP for this information.
- ID
- xccdf_org.ssgproject.content_rule_dhcp_server_minimize_served_info
- Severity
- Unknown
- References
- Updated