Disable dnsmasq Service
Ensures the lightweight DNS/DHCP server dnsmasq.service is disabled and not running unless the host is intentionally a caching/forwarding resolver.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Unless a system is specifically designated to act as a DNS caching, DNS forwarding and/or DHCP server, dnsmasq should be disabled to reduce the potential attack surface and avoid exposing a network-facing resolver.
What Pavois checks
Pavois queries the resolved unit state with systemctl is-enabled / is-active for dnsmasq.service. The effective state catches a resolver enabled via a drop-in or socket activation that scanning /etc/dnsmasq.conf and /etc/dnsmasq.d/ files would miss.
describe service('dnsmasq.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Run systemctl is-enabled dnsmasq.service (expected disabled or not-found) and systemctl is-active dnsmasq.service (expected inactive).
Inspect & investigate
Check systemctl show dnsmasq.service (fields UnitFileState, ActiveState) and journalctl -u dnsmasq.service; query/lease activity also appears in /var/log/syslog.
Remediation
Pavois's harden plan applies a service resource for dnsmasq with actions disable and stop, so the resolver stays off across reboots and is stopped immediately. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | dnsmasq |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
On hosts not acting as a DNS/DHCP server, disabling dnsmasq.service has no functional impact. Precaution: some setups (libvirt/NetworkManager local DNS, container DNS) rely on dnsmasq, if so, name resolution or VM networking could break; verify nothing depends on it (e.g. /etc/resolv.conf pointing at 127.0.0.1) before applying.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.5, 2.1.6 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.