Skip to content

0019-hosts-exist-hosts Deleted


Rule ID

  • 0019-hosts-exist

Category

  • system

Severity

  • critical

Compatible Versions

  • Linux

Description

  • Monitors whether the host /etc/hosts file exists.

Scan Frequency

  • 1 */5 * * *

Rationale

  • The hosts file is a file in Linux systems responsible for quick IP address to domain name resolution. It is stored in ASCII format under the /etc directory with the filename hosts. The hosts file contains mappings between IP addresses and hostnames, as well as aliases for hostnames. In the absence of a domain name server, all network programs on the system resolve the IP address corresponding to a hostname by querying this file; otherwise, the DNS service program must be used. Commonly used domain names and IP address mappings can be added to the hosts file for fast and convenient access. Malicious deletion of the hosts file can cause service unavailability.

Risk Items

  • Service unavailability

Audit Method

  • Verify the host /etc/hosts file. Run the following command to verify:
ls /etc/hosts

Remediation

  • If /etc/hosts is deleted, execute the touch /etc/hosts command to recreate it.

Impact

  • None

Default Value

  • None

References

CIS Controls

  • None

Feedback

Is this page helpful?