Profile Applicability:
 • Level 1

Description:
 DHCP server services dynamically assign IP addresses and network configuration to clients. If the system is not intended to act as a DHCP server, these services should be disabled to reduce unnecessary network exposure and prevent potential unauthorized network configurations.

Rationale:
 Disabling unused DHCP server services minimizes the attack surface and prevents unintended network behavior or misconfigurations.

Impact:
 Pros:

  • Reduces risk of unauthorized IP address assignments.

  • Limits network exposure and potential attack vectors.

Cons:

  • Disabling DHCP server services on systems that require them may cause network issues.

Default Value:
 DHCP server services may be enabled by default on some systems.

Pre-requisites:

  • Root or sudo privileges to manage system services.

Remediation:

Test Plan:

Using Linux command line:

1. Check if DHCP server service is enabled:

systemctl is-enabled dhcpd  
systemctl is-enabled isc-dhcp-server

2. Check if DHCP server service is running:

systemctl status dhcpd  
systemctl status isc-dhcp-server

Implementation Plan:

Using Linux command line:

1. Disable DHCP server services:

systemctl disable dhcpd  
systemctl disable isc-dhcp-server

2. Stop running DHCP server services:

systemctl stop dhcpd  
systemctl stop isc-dhcp-server

3. Verify services are disabled and stopped:

systemctl is-enabled dhcpd  
systemctl is-enabled isc-dhcp-server  
systemctl status dhcpd  
systemctl status isc-dhcp-server

Backout Plan:

Using Linux command line:

1. Enable and start DHCP server services if required:

systemctl enable dhcpd  
systemctl start dhcpd  
systemctl enable isc-dhcp-server  
systemctl start isc-dhcp-server

2. Verify service status.

References:

  • CIS Amazon Linux 2 Benchmark v3.0.0

  • Systemd Service Management