# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEB-SVC-022
title: Disable the Avahi mDNS/DNS-SD daemon
finding:
  title: Avahi announces the system and its services on the local network
  description: Zero-configuration discovery tells every host on the segment what this system is and offers.
status: active
profiles: [server, desktop-hardened]
risk:
  severity: medium
assessment: automated
tags: [services, avahi, mdns, attack-surface]

description: |
  `avahi-daemon` implements multicast DNS and DNS service discovery (Zeroconf, Bonjour) on UDP
  port 5353. It is started by `avahi-daemon.service` and by `avahi-daemon.socket`.

  The control passes when both units are masked or not installed at all.
rationale: |
  Avahi publishes the host name, the services it offers and sometimes the operating system to
  the local network, and accepts multicast packets from any host there. Servers have fixed names
  and addresses and do not need it.
impact: |
  `.local` names are no longer resolved or published, and automatic discovery of printers and
  file shares stops. Desktops that rely on it keep it through the standard desktop profile; only
  the hardened desktop profile disables it.
notes: |
  Masking both the service and the socket is needed: either one can start the daemon. The
  `libnss-mdns` resolver stays installed and simply gets no answers.

audit:
  manual: |
    Run `systemctl is-enabled avahi-daemon.service avahi-daemon.socket`. Each must print `masked`,
    or the command must fail because the units do not exist.
  logic: all
  checks:
    - id: avahi-socket
      engine: systemd-unit
      description: Avahi socket activation.
      spec: { unit: avahi-daemon.socket, state: masked }
    - id: avahi-daemon
      engine: systemd-unit
      description: Avahi daemon.
      spec: { unit: avahi-daemon.service, state: masked }

remediation:
  manual: |
    Run `systemctl mask --now avahi-daemon.socket avahi-daemon.service`, or `apt purge avahi-daemon`
    if nothing depends on it.
  effects:
    restart: none
    disruption: low
    lockout_risk: false
  rollback: |
    Run `systemctl unmask avahi-daemon.socket avahi-daemon.service` then
    `systemctl enable --now avahi-daemon.service`.
  scripts:
    - id: avahi-socket
      from_check: avahi-socket
    - id: avahi-daemon
      from_check: avahi-daemon

references:
  - title: avahi-daemon(8), Debian manual pages
    url: https://manpages.debian.org/trixie/avahi-daemon/avahi-daemon.8.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
  - title: ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62)
    url: https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf
    publisher: ANSSI
    kind: guide
    accessed: 2026-10-18
mappings:
  - framework: anssi-linux
    framework_version: "2.0"
    id: R62
    relation: partial
    note: R62 asks to disable every unneeded service and names Avahi; this control covers it.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: CM-7
    relation: partial
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "2.1.3"
    relation: equivalent
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "2.1.2"
    relation: equivalent
threats:
  - framework: mitre-attack
    id: T1046
  - framework: mitre-attack
    id: T1557

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["12"]
    environment: Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64
    notes: "Fresh image passes; with avahi-daemon installed both checks fail, fix masks service and socket, audit passes after reboot; tested with profiles server-hardened and desktop-hardened."
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["13"]
    environment: Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64
    notes: "Fresh image passes; with avahi-daemon installed both checks fail, fix masks service and socket, audit passes after reboot; tested with profiles server-hardened and desktop-hardened."
introduced_in: 0.1.0
created: 2026-10-18
updated: 2026-10-18