Description
avahi-daemon implements multicast DNS and DNS service discovery (Zeroconf, Bonjour) on UDP
port 5353. It is started by avahi-daemon.service and by avahi-daemon.socket.
The control passes when both units are masked or not installed at all.
Masking both the service and the socket is needed: either one can start the daemon. The
libnss-mdns resolver stays installed and simply gets no answers.
Rationale
Avahi publishes the host name, the services it offers and sometimes the operating system to the local network, and accepts multicast packets from any host there. Servers have fixed names and addresses and do not need it.
Impact
.local names are no longer resolved or published, and automatic discovery of printers and
file shares stops. Desktops that rely on it keep it through the standard desktop profile; only
the hardened desktop profile disables it.
Audit
Run systemctl is-enabled avahi-daemon.service avahi-daemon.socket. Each must print masked,
or the command must fail because the units do not exist.
Automated: every check must pass. Scanners report each check by its id.
avahi-socket
Avahi socket activation.
unit: avahi-daemon.socket
state: masked
avahi-daemon
Avahi daemon.
unit: avahi-daemon.service
state: masked
Remediation
Run systemctl mask --now avahi-daemon.socket avahi-daemon.service, or apt purge avahi-daemon
if nothing depends on it.
| Restart | none |
| Disruption | low |
Rollback
Run systemctl unmask avahi-daemon.socket avahi-daemon.service then
systemctl enable --now avahi-daemon.service.
avahi-socket
Generated from check avahi-socket: the engine writes the fix for every output, it sets the expected value and the check runs again after.
avahi-daemon
Generated from check avahi-daemon: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- avahi-daemon(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-18
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R62 | partial | R62 asks to disable every unneeded service and names Avahi; this control covers it. |
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | partial |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1046 |
| MITRE ATT&CK | T1557 |
People and lifecycle
| Authors |
|
| Verified | 2026-10-18 by Sn0wAlice on 12, Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Fresh image passes; with avahi-daemon installed both checks fail, fix masks service and socket, audit passes after reboot; tested with profiles server-hardened and desktop-hardened. |
| Verified | 2026-10-18 by Sn0wAlice on 13, Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Fresh image passes; with avahi-daemon installed both checks fail, fix masks service and socket, audit passes after reboot; tested with profiles server-hardened and desktop-hardened. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |
