{
  "id": "CB-UBU-SVC-022",
  "standard": "ubuntu",
  "version": "0.1.2",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-SVC-022",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-SVC-022.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-SVC-022.yml",
  "profiles_effective": [
    "server",
    "server-hardened",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-SVC-022",
    "title": "Disable the Avahi mDNS/DNS-SD daemon",
    "finding": {
      "title": "Avahi announces the system and its services on the local network",
      "description": "Zero-configuration discovery tells every host on the segment what this system is and offers."
    },
    "status": "active",
    "profiles": [
      "server",
      "desktop-hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "services",
      "avahi",
      "mdns",
      "attack-surface"
    ],
    "description": "`avahi-daemon` implements multicast DNS and DNS service discovery (Zeroconf, Bonjour) on UDP\nport 5353. It is started by `avahi-daemon.service` and by `avahi-daemon.socket`.\n\nThe control passes when both units are masked or not installed at all.\n",
    "rationale": "Avahi publishes the host name, the services it offers and sometimes the operating system to\nthe local network, and accepts multicast packets from any host there. Servers have fixed names\nand addresses and do not need it.\n",
    "impact": "`.local` names are no longer resolved or published, and automatic discovery of printers and\nfile shares stops. Desktops that rely on it keep it through the standard desktop profile; only\nthe hardened desktop profile disables it.\n",
    "notes": "Masking both the service and the socket is needed: either one can start the daemon. The\n`libnss-mdns` resolver stays installed and simply gets no answers.\n",
    "audit": {
      "manual": "Run `systemctl is-enabled avahi-daemon.service avahi-daemon.socket`. Each must print `masked`,\nor the command must fail because the units do not exist.\n",
      "logic": "all",
      "checks": [
        {
          "id": "avahi-socket",
          "engine": "systemd-unit",
          "description": "Avahi socket activation.",
          "spec": {
            "unit": "avahi-daemon.socket",
            "state": "masked"
          }
        },
        {
          "id": "avahi-daemon",
          "engine": "systemd-unit",
          "description": "Avahi daemon.",
          "spec": {
            "unit": "avahi-daemon.service",
            "state": "masked"
          }
        }
      ]
    },
    "remediation": {
      "manual": "Run `systemctl mask --now avahi-daemon.socket avahi-daemon.service`, or `apt purge avahi-daemon`\nif nothing depends on it.\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": false
      },
      "rollback": "Run `systemctl unmask avahi-daemon.socket avahi-daemon.service` then\n`systemctl enable --now avahi-daemon.service`.\n",
      "scripts": [
        {
          "id": "avahi-socket",
          "from_check": "avahi-socket"
        },
        {
          "id": "avahi-daemon",
          "from_check": "avahi-daemon"
        }
      ]
    },
    "references": [
      {
        "title": "avahi-daemon(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/avahi-daemon.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62)",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R62",
        "relation": "partial",
        "note": "R62 asks to disable every unneeded service and names Avahi; this control covers it."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "partial"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1046"
      },
      {
        "framework": "mitre-attack",
        "id": "T1557"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Stock image passes (units absent); with avahi-daemon installed the check fails, server-hardened remediation masks the units, audit passes, unchanged on a second run and after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Stock image passes (units absent); with avahi-daemon installed the check fails, server-hardened remediation masks the units, audit passes, unchanged on a second run and after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Stock image passes (units absent); with avahi-daemon installed the check fails, server-hardened remediation masks the units, audit passes, unchanged on a second run and after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Stock image passes (units absent); with avahi-daemon installed the check fails, server-hardened remediation masks the units, audit passes, unchanged on a second run and after reboot."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}