Disable DHCP and DNS server services the system does not provide

Description

Debian packages several network infrastructure servers:

• DHCP: isc-dhcp-server (isc-dhcp-server, isc-dhcp-server6) and Kea (kea-dhcp4-server, kea-dhcp6-server, kea-dhcp-ddns-server);
• DNS: BIND (named);
• dnsmasq, a combined DNS forwarder and DHCP server (dnsmasq).

The control passes when each unit is masked or not installed at all.

The check reads systemctl is-enabled: a unit that does not exist counts as compliant, so removing the package (apt purge) is an equally valid fix. The packages are not installed on a default Debian install.

Rationale

These daemons answer requests from any host on the network. A rogue or forgotten DHCP or DNS server can redirect clients to an attacker, and every running daemon is code that can be exploited remotely.

Impact

Masking a unit stops it and prevents it from starting again, even as a dependency. Systems whose role is to provide DHCP or DNS must exclude this control in their tailoring file. The dnsmasq binary used by libvirt or NetworkManager (dnsmasq-base) is not affected: only the stand-alone dnsmasq service is masked.

Audit

For each unit, run systemctl is-enabled <unit>. It must print masked, or fail because the unit does not exist: isc-dhcp-server.service, isc-dhcp-server6.service, kea-dhcp4-server.service, kea-dhcp6-server.service, kea-dhcp-ddns-server.service, named.service, dnsmasq.service.

Automated: every check must pass. Scanners report each check by its id.

isc-dhcp-server

ISC DHCPv4 server.

unit: isc-dhcp-server.service
state: masked

isc-dhcp-server6

ISC DHCPv6 server.

unit: isc-dhcp-server6.service
state: masked

kea-dhcp4

Kea DHCPv4 server.

unit: kea-dhcp4-server.service
state: masked

kea-dhcp6

Kea DHCPv6 server.

unit: kea-dhcp6-server.service
state: masked

kea-dhcp-ddns

Kea dynamic DNS update server.

unit: kea-dhcp-ddns-server.service
state: masked

named

BIND DNS server.

unit: named.service
state: masked

dnsmasq

dnsmasq DNS and DHCP server.

unit: dnsmasq.service
state: masked

Remediation

Stop and mask each unit that is installed: systemctl mask --now <unit>. If the package is not needed at all, remove it instead: apt purge isc-dhcp-server kea-dhcp4-server kea-dhcp6-server kea-dhcp-ddns-server bind9 dnsmasq.

Rollback

Run systemctl unmask <unit> then systemctl enable --now <unit>.

isc-dhcp-server

Generated from check isc-dhcp-server: the engine writes the fix for every output, it sets the expected value and the check runs again after.

isc-dhcp-server6

Generated from check isc-dhcp-server6: the engine writes the fix for every output, it sets the expected value and the check runs again after.

kea-dhcp4

Generated from check kea-dhcp4: the engine writes the fix for every output, it sets the expected value and the check runs again after.

kea-dhcp6

Generated from check kea-dhcp6: the engine writes the fix for every output, it sets the expected value and the check runs again after.

kea-dhcp-ddns

Generated from check kea-dhcp-ddns: the engine writes the fix for every output, it sets the expected value and the check runs again after.

named

Generated from check named: the engine writes the fix for every output, it sets the expected value and the check runs again after.

dnsmasq

Generated from check dnsmasq: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• systemctl(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• dhcpd(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• named(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• dnsmasq(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle