Description
avahi-daemon implements multicast DNS and DNS service discovery (Zeroconf, Bonjour) on UDP
port 5353. It is started by avahi-daemon.service and by avahi-daemon.socket.
The control passes when both units are masked or not installed at all.
Masking both the service and the socket is needed: either one can start the daemon. The
libnss-mdns resolver stays installed and simply gets no answers.
Rationale
Avahi publishes the host name, the services it offers and sometimes the operating system to the local network, and accepts multicast packets from any host there. Servers have fixed names and addresses and do not need it.
Impact
.local names are no longer resolved or published, and automatic discovery of printers and
file shares stops. Desktops that rely on it keep it through the standard desktop profile; only
the hardened desktop profile disables it.
Audit
Run systemctl is-enabled avahi-daemon.service avahi-daemon.socket. Each must print masked,
or the command must fail because the units do not exist.
Automated: every check must pass. Scanners report each check by its id.
avahi-socket
Avahi socket activation.
unit: avahi-daemon.socket
state: masked
avahi-daemon
Avahi daemon.
unit: avahi-daemon.service
state: masked
Remediation
Run systemctl mask --now avahi-daemon.socket avahi-daemon.service, or apt purge avahi-daemon
if nothing depends on it.
| Restart | none |
| Disruption | low |
Rollback
Run systemctl unmask avahi-daemon.socket avahi-daemon.service then
systemctl enable --now avahi-daemon.service.
avahi-socket
Generated from check avahi-socket: the engine writes the fix for every output, it sets the expected value and the check runs again after.
avahi-daemon
Generated from check avahi-daemon: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- avahi-daemon(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-19
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R62 | partial | R62 asks to disable every unneeded service and names Avahi; this control covers it. |
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | partial |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1046 |
| MITRE ATT&CK | T1557 |
People and lifecycle
| Authors |
|
| Verified | 2026-10-19 by Sn0wAlice on 20.04, Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic. Stock image passes (units absent); with avahi-daemon installed the check fails, server-hardened remediation masks the units, audit passes, unchanged on a second run and after reboot. |
| Verified | 2026-10-19 by Sn0wAlice on 22.04, Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic. Stock image passes (units absent); with avahi-daemon installed the check fails, server-hardened remediation masks the units, audit passes, unchanged on a second run and after reboot. |
| Verified | 2026-10-19 by Sn0wAlice on 24.04, Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic. Stock image passes (units absent); with avahi-daemon installed the check fails, server-hardened remediation masks the units, audit passes, unchanged on a second run and after reboot. |
| Verified | 2026-10-19 by Sn0wAlice on 26.04, Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic. Stock image passes (units absent); with avahi-daemon installed the check fails, server-hardened remediation masks the units, audit passes, unchanged on a second run and after reboot. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-19, 2026-10-19 |
| Translations | fr |
