>From 6379c05115f75f2876c8e6d841d8d430baef2ee3 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Fri, 16 Nov 2012 07:04:26 -0500 Subject: [PATCH 05/13] DISA FSO provided copy editing of RHEL6/input/services/dhcp.xml DISA FSO provided copy editing of RHEL6/input/services/dhcp.xml --- RHEL6/input/services/dhcp.xml | 28 ++++++++++++++-------------- 1 files changed, 14 insertions(+), 14 deletions(-) diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml index 9511ba6..7cf381b 100644 --- a/RHEL6/input/services/dhcp.xml +++ b/RHEL6/input/services/dhcp.xml @@ -123,7 +123,7 @@ allocations. Deny BOOTP Queries Unless your network needs to support older BOOTP clients, disable -support for the bootp protocol by adding or correcting the global option: +support for the bootp protocol by adding or correcting the global option.
deny bootp;
The bootp option tells dhcpd to respond to BOOTP queries. If support @@ -139,7 +139,7 @@ vectors against the DHCP server. Minimize Served Information Edit /etc/dhcpd.conf. Examine each address range section within the file, and ensure that the following options are not defined unless there is -an operational need to provide this information via DHCP: +an operational need to provide this information via DHCP.
option domain-name
 option domain-name-servers
 option nis-domain
@@ -173,7 +173,7 @@ usually static across machines at a given site.
 
 Configure Logging
 Ensure that the following line exists in
-/etc/syslog.conf:
+/etc/syslog.conf.
 
daemon.*           /var/log/daemon.log
Configure logwatch or other log monitoring tools to summarize error conditions reported by the dhcpd process.
@@ -201,13 +201,13 @@ accountability for network activity. For each interface IFACE on the system (e.g. eth0), edit /etc/sysconfig/network-scripts/ifcfg-IFACE and make the -following changes: +following changes.
    -
  • Correct the BOOTPROTO line to read: +
  • Correct the BOOTPROTO line to read.
    BOOTPROTO=static
  • Add or correct the following lines, substituting the appropriate -values based on your site's addressing scheme: +values based on your site's addressing scheme.
    NETMASK=255.255.255.0
     IPADDR=192.168.1.2
     GATEWAY=192.168.1.1
    @@ -215,11 +215,11 @@ GATEWAY=192.168.1.1
-To verify that DHCP is not being used, examine the following file for each interface: +To verify that DHCP is not being used, examine the following file for each interface.
# /etc/sysconfig/network-scripts/ifcfg-IFACE
-Look for the following: +Look for the following.
BOOTPROTO=static
-and the following, substituting the appropriate values based on your site's addressing scheme: +and the following, substituting the appropriate values based on your site's addressing scheme.
NETMASK=255.255.255.0
 IPADDR=192.168.1.2
 GATEWAY=192.168.1.1
@@ -248,16 +248,16 @@ dhclient(8) and dhclient.conf(5) man pages. Minimize the DHCP-Configured Options Create the file /etc/dhclient.conf, and add an appropriate setting for each of the ten configuration settings which can be -obtained via DHCP. For each setting, do one of the following: +obtained via DHCP. For each setting, do one of the following.
If the setting should not be configured remotely by the DHCP server, -select an appropriate static value, and add the line: +select an appropriate static value, and add the line.
supersede setting value;
-If the setting should be configured remotely by the DHCP server, add the lines: +If the setting should be configured remotely by the DHCP server, add the lines.
request setting;
 require setting;
For example, suppose the DHCP server should provide only the IP address itself -and the subnet mask. Then the entire file should look like: +and the subnet mask. Then the entire file should look like.
supersede domain-name "example.com";
 supersede domain-name-servers 192.168.1.2;
 supersede nis-domain "";
@@ -269,7 +269,7 @@ request subnet-mask;
 require subnet-mask;
By default, the DHCP client program, dhclient, requests and applies -ten configuration options (in addition to the IP address) from the DHCP server: +ten configuration options (in addition to the IP address) from the DHCP server. subnet-mask, broadcast-address, time-offset, routers, domain-name, domain-name-servers, host-name, nis-domain, nis-servers, and ntp-servers. Many of the options requested and applied by dhclient may be the same for every -- 1.7.1