0087-avahi-uninstalled¶

Rule ID¶

• 0087-avahi-uninstalled

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• Avahi is a free zeroconf implementation, including a system for multicast DNS/DNS-SD service discovery. Avahi allows programs to publish and discover services and hosts running on a local network. For example, a user can plug a computer into a network, and Avahi will automatically find printers to print to, files to view, people to talk to, and network services running on the machine.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• Automatic discovery of network services is typically not required for system functionality. It is recommended to remove this package to reduce the potential attack surface.

Risk Items¶

• Increased attack surface

Audit Method¶

• Run the following command to verify that the corresponding components are not installed:

  # rpm -q avahi-autoipd avahi
  package avahi-autoipd is not installed
  package avahi is not installed
  

Remediation¶

• Run the following commands to remove the corresponding packages:

  # systemctl stop avahi-daemon.socket avahi-daemon.service
  # yum remove avahi-autoipd avahi
  

Impact¶

• Systems that rely on Avahi as a DNS alternative may lose domain name resolution support.

Default Value¶

• None

References¶

• None

CIS Controls¶

• Version 7 2.6 Address Unapproved Software Ensure that unauthorized software is removed, or the inventory is updated in a timely manner.