Uninstall kea Package
Ensures the kea ISC DHCP server package is not installed unless the host is an intended DHCP server.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
kea is the ISC DHCP server. A DHCP server hands out IP addresses and network parameters to clients; if it runs where it is not needed it can disrupt the network (rogue/conflicting leases) and exposes a network-facing daemon to exploitation. Removing the package, rather than just stopping the service, ensures it cannot be easily or accidentally reactivated and reduces the attack surface.
What Pavois checks
Pavois queries the package database via InSpec package('kea') (dpkg -s kea / rpm -q kea) and asserts it is not installed. Checking the package state is more reliable than checking whether a service is stopped: a stopped kea-dhcp4 unit can be re-enabled at any time, whereas an absent package cannot serve DHCP at all.
describe package('kea') do
it { should_not be_installed }
endHow to verify it is applied
On Debian run dpkg -s kea and expect package 'kea' is not installed; on Fedora run rpm -q kea and expect package kea is not installed. Any installed version string means the rule fails.
Inspect & investigate
Use the package manager history to confirm removal: apt list --installed | grep kea (should be empty) or dnf history. If kea was running, journalctl -u kea-dhcp4-server shows past lease activity; /var/log/apt/history.log records the removal transaction on Debian.
Remediation
Pavois's harden plan declares a package resource named kea with action remove; pavois harden apply runs the equivalent of apt-get remove kea (or dnf remove kea) to reach the compliant state. If remediation were empty you would uninstall it manually.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | kea |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing kea will stop and delete the DHCP server. Precaution: only apply on hosts that are not meant to provide DHCP. If this machine actually serves leases to a LAN, uninstalling it will cut off address allocation for every client that depends on it, clients will lose connectivity as their leases expire. Confirm the role first (systemctl is-enabled kea-dhcp4-server, check /etc/kea/) and migrate the service before removing.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| CIS | 2.1.4 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.