Disable DCCP Support
Ensures the dccp kernel module is not loaded and is blacklisted so the network-reachable DCCP protocol cannot be activated.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
DCCP (Datagram Congestion Control Protocol) is a rarely used transport protocol. Because it is reachable over the network, its kernel module presents a remotely exploitable attack surface, and it has a history of serious bugs (e.g. CVE-2017-6074, a use-after-free giving local privilege escalation). Disabling the unused module protects the system against exploitation of any flaws in its implementation.
What Pavois checks
Pavois uses kernel_module('dccp') to assert the module is not loaded and is disabled in the effective modprobe policy. Querying the live kernel and resolved modprobe config (not a single .conf) catches a module blacklisted in one file yet still loaded, or re-enabled by an override, important because DCCP can be auto-loaded by an application opening a DCCP socket.
describe kernel_module('dccp') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
Run lsmod | grep dccp (no output = not loaded) and modprobe -n -v dccp (expect install /bin/true or /bin/false). modprobe --showconfig | grep dccp shows the effective rules.
Inspect & investigate
Blocked load attempts appear in the kernel log: journalctl -k | grep -i dccp / dmesg | grep -i dccp. lsmod shows resident modules; modprobe --showconfig shows the policy.
Remediation
pavois harden apply uses the kernel_module resource to blacklist dccp: it writes a modprobe rule (install dccp /bin/false plus a blacklist entry) so the protocol cannot be auto-loaded by a socket request, and unloads it if resident. reboot_required is true to guarantee removal.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | dccp |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
On a standard server, disabling dccp has no functional impact, almost no software uses it. Precaution: the rare application that explicitly opens DCCP sockets would fail; confirm none does (e.g. ss -A dccp shows no sockets) before applying. A reboot is needed to unload an already-loaded module.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.4.2, 3.2.1, 3.2.3 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.6, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 1.4.2 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.