Uninstall bind Package
Ensures the BIND DNS server package is not installed unless the host is intended to be a DNS server.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
BIND (named) is a full DNS server that listens on the network and has a long history of high-severity vulnerabilities. If the host is not meant to serve DNS, having the package installed adds an unnecessary, potentially internet-facing service that an attacker could start or exploit. Removing it enforces least functionality (CIS 2.1.4/2.1.5, NIST CM-7).
What Pavois checks
Pavois asks the package database (via dpkg/rpm) whether bind is installed and expects it absent. Checking the effective package state is authoritative regardless of whether the named service is currently stopped or masked.
describe package('bind9') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q bind (RHEL-family) or dpkg -s bind9 (Debian/Ubuntu, where the package is bind9), expected not installed. Confirm nothing listens on port 53 with ss -lntup | grep ':53' (expected no named).
Inspect & investigate
rpm -q bind/dpkg -l bind9confirm removal.- While installed, the DNS server logs to
journalctl -u named(RHEL) orjournalctl -u named/bind9(Debian) and its listening socket is visible withss -lntup(port 53).
Remediation
Pavois's harden plan removes the bind package (package resource, remove action) with pavois harden apply, stopping and disabling the named service in the process.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | bind9 |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing BIND breaks the host as a DNS server, do not apply this on an authoritative or caching DNS server. Before applying, confirm the host is not serving DNS to other systems (check ss on port 53 and downstream resolver configs). Note this control targets the DNS server; it does not affect the system's own resolver (systemd-resolved/resolv.conf).
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.4, 2.1.5 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.