Disable DHCPD6 Service
Ensures the IPv6 DHCP server (dhcpd6.service) is disabled and not running unless the host is an intentional DHCPv6 server.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
An unmanaged or unintentionally activated DHCPv6 server can hand out faulty addresses, routes or DNS to clients, hijacking IPv6 traffic and disrupting a legitimate DHCP server on the network.
What Pavois checks
Pavois queries the resolved unit state with systemctl is-enabled / is-active for dhcpd6.service. The effective state reveals a server enabled by a drop-in or socket activation that inspecting /etc/dhcp config files alone would not detect.
describe service('isc-dhcp-server6.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Run systemctl is-enabled dhcpd6.service (expected disabled or not-found) and systemctl is-active dhcpd6.service (expected inactive).
Inspect & investigate
Check systemctl show dhcpd6.service (fields UnitFileState, ActiveState) and journalctl -u dhcpd6.service; rogue lease activity also surfaces in /var/log/syslog.
Remediation
Pavois's harden plan applies a service resource for dhcpd6 with actions disable and stop, so the IPv6 DHCP server stays off across reboots and is stopped immediately. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | isc-dhcp-server6.service |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
On a host that is not a DHCPv6 server, disabling dhcpd6.service has no functional impact. Precaution: if this machine legitimately serves IPv6 leases, do not disable it, clients would lose their IPv6 addressing; document the exception instead.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.3 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.