Uninstall DHCP Server Package
Ensures the DHCP server package is not installed on hosts that are not meant to hand out IP addresses.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Removing the DHCP server ensures it cannot be easily or accidentally reactivated and disrupt network operation, and it reduces the attack surface.
What Pavois checks
Pavois verifies that the dhcp server package is absent via the package manager. A rogue or accidental DHCP server can hijack address assignment for an entire subnet; removing the package, rather than only stopping the service, guarantees it cannot be started or auto-enabled.
describe package('isc-dhcp-server') do
it { should_not be_installed }
endHow to verify it is applied
On RHEL family run rpm -q dhcp-server; on Debian/Ubuntu run dpkg -s isc-dhcp-server. Both should report the package is not installed. Confirm nothing listens on UDP/67 with ss -ulnp | grep ':67'.
Inspect & investigate
Confirm removal with rpm -q dhcp-server or dpkg -l isc-dhcp-server; while present, DHCP lease activity appears via journalctl -u dhcpd (or isc-dhcp-server).
Remediation
Pavois's harden plan removes the dhcp package (resource package, action remove) and is applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | isc-dhcp-server |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing the DHCP server stops the host from assigning IP addresses. Before applying, confirm this host is not your subnet's DHCP server, removing it there would leave clients unable to obtain addresses and break network connectivity. This rule targets the DHCP server; the DHCP client used to obtain the host's own address is unaffected.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| CIS | 2.1.3, 2.2.4, 2.1.4 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.