Disable Avahi Server Software
Disables and stops the avahi-daemon mDNS/DNS-SD service to close its network port and stop host advertisement.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Avahi is a zero-configuration (mDNS/DNS-SD) service-discovery daemon. It keeps an open network port (UDP 5353) and advertises the host on the local network, exposing it to network-based attacks and information disclosure. On servers it is almost never needed and only adds attack surface; it is appropriate only on trusted local networks where automatic discovery is genuinely required.
What Pavois checks
Pavois queries systemd for the effective state of avahi-daemon.service (systemctl is-enabled / is-active), so it detects the daemon running or socket-activated regardless of /etc/avahi/avahi-daemon.conf. A config-file scan cannot confirm whether the daemon is actually bound to UDP 5353 right now, only the live service state can.
describe service('avahi-daemon.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Confirm the unit is off:
systemctl is-enabled avahi-daemon.service
systemctl is-active avahi-daemon.service
Expect disabled (or masked) and inactive. Also confirm nothing listens on mDNS: ss -lunp | grep 5353 should return nothing.
Inspect & investigate
Inspect the unit with systemctl status avahi-daemon.service and journalctl -u avahi-daemon.service. Confirm the listening socket is gone with ss -lunp 'sport = :5353'. Package presence: dpkg -s avahi-daemon or rpm -q avahi.
Remediation
Pavois's harden plan acts on the service resource named avahi-daemon: it runs disable (no start at boot) then stop (not running now). Applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | avahi-daemon |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Misconfiguration risk: a running Avahi daemon advertises the host and exposes a network port to local attackers. Precautions: disabling it removes mDNS-based discovery, so .local hostname resolution and automatic discovery of network printers or shares will stop working for this host. On servers this is normally desirable; on desktops or appliances that rely on Bonjour/Zeroconf printing or casting, confirm those workflows are not needed before applying. There is no remote-login or lockout risk.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.2, 2.2.4 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.