From shawn at redhat.com Thu Aug 20 11:34:39 2015 Content-Type: multipart/mixed; boundary="===============6346765173176546122==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] DHCP section referred to the wrong file location for dhcpd.conf Date: Mon, 22 Jul 2013 19:23:59 -0400 Message-ID: <51EDBF0F.2060100@redhat.com> In-Reply-To: 1374526627-12434-1-git-send-email-maura@eclipse.ncsc.mil --===============6346765173176546122== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 7/22/13 4:57 PM, Maura Dailey wrote: > Signed-off-by: Maura Dailey > --- > RHEL6/input/services/dhcp.xml | 14 +++++++------- > 1 files changed, 7 insertions(+), 7 deletions(-) > > diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml > index 4190c07..a611adc 100644 > --- a/RHEL6/input/services/dhcp.xml > +++ b/RHEL6/input/services/dhcp.xml > @@ -75,7 +75,7 @@ accidentally reactivated and disrupt network operation. > If the system must act as a DHCP server, the configuration > information it serves should be minimized. Also, support for other prot= ocols > and DNS-updating schemes should be explicitly disabled unless needed. T= he > -configuration file for dhcpd is called /etc/dhcpd.conf. The file > +configuration file for dhcpd is called /etc/dhcp/dhcpd.conf. Th= e file > begins with a number of global configuration options. The remainder of = the file > is divided into sections, one for each block of addresses offered by dh= cpd, > each of which contains configuration options specific to that address > @@ -84,7 +84,7 @@ block. > > Do Not Use Dynamic DNS > To prevent the DHCP server from receiving DNS information = from > -clients, edit /etc/dhcpd.conf, and add or correct the following= global > +clients, edit /etc/dhcp/dhcpd.conf, and add or correct the foll= owing global > option:
ddns-update-style none;
>
> The Dynamic DNS protocol is used to remotely update the data= served > @@ -107,7 +107,7 @@ best practice). > = > > Deny Decline Messages > -Edit /etc/dhcpd.conf and add or correct the follow= ing > +Edit /etc/dhcp/dhcpd.conf and add or correct the f= ollowing > global option to prevent the DHCP server from responding the DHCPDECLINE > messages, if possible:
deny declines;
> The DHCPDECLINE message can be sent by a DHCP client to indi= cate > @@ -137,7 +137,7 @@ vectors against the DHCP server. > = > > Minimize Served Information > -Edit /etc/dhcpd.conf. Examine each address range section wi= thin > +Edit /etc/dhcp/dhcpd.conf. Examine each address range secti= on within > the file, and ensure that the following options are not defined unless = there is > an operational need to provide this information via DHCP: >
option domain-name
> @@ -173,7 +173,7 @@ usually static across machines at a given site.
>   
>   Configure Logging
>   Ensure that the following line exists in
> -/etc/syslog.conf:
> +/etc/rsyslog.conf:
>   
daemon.*           /var/log/daemon.log
> Configure logwatch or other log monitoring tools to summarize error con= ditions > reported by the dhcpd process.
> @@ -246,7 +246,7 @@ successfully distribute. For more information on con= figuring dhclient, see the > = > > Minimize the DHCP-Configured Options > -Create the file /etc/dhclient.conf, and add an > +Create the file /etc/dhcp/dhclient.conf, and add an > appropriate setting for each of the ten configuration settings which ca= n be > obtained via DHCP. For each setting, do one of the following: >
> @@ -277,7 +277,7 @@ system on a network. It is recommended that almost al= l configuration options be > assigned statically, and only options which must vary on a host-by-host= basis > be assigned via DHCP. This limits the damage which can be done by a rog= ue DHCP > server. If appropriate for your site, it is also possible to supersede= the > -host-name directive in /etc/dhclient.conf, establishing a static > +host-name directive in /etc/dhcp/dhclient.conf, establishing a = static > hostname for the machine. However, dhclient does not use the host name = option > provided by the DHCP server (instead using the value provided by a reve= rse DNS > lookup). > -- 1.7.1 Ack --===============6346765173176546122==--