Uninstall dnsmasq Package
Ensures the dnsmasq lightweight DNS/DHCP server is not installed on hosts that do not provide those services.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Unless a system is specifically designated to act as a DNS caching, DNS forwarding and/or DHCP server, the dnsmasq package should be removed to reduce the potential attack surface.
What Pavois checks
Pavois verifies that the dnsmasq package is absent via the package manager. Removing it ensures no DNS forwarder or DHCP responder can be started or auto-enabled, stronger than merely stopping the service, since a present binary still listens by default and carries its own CVEs.
describe package('dnsmasq') do
it { should_not be_installed }
endHow to verify it is applied
On Debian/Ubuntu run dpkg -s dnsmasq (and dnsmasq-base); on RHEL family run rpm -q dnsmasq. Both should report the package is not installed. Confirm nothing listens on port 53 with ss -ulnp | grep ':53'.
Inspect & investigate
Confirm removal with dpkg -l dnsmasq or rpm -q dnsmasq; while present, dnsmasq logs DNS/DHCP activity via journalctl -u dnsmasq.
Remediation
Pavois's harden plan removes the dnsmasq package (resource package, action remove) and is applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | dnsmasq |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing dnsmasq disables any local DNS caching/forwarding or DHCP it was providing. Before applying, confirm nothing relies on it, notably some libvirt/NetworkManager setups use dnsmasq for virtual-network DNS/DHCP, and removing it can break VM connectivity or local name resolution. On hosts that do not use it, there is no impact.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.5, 2.1.6 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.