On Wed, 2014-01-08 at 13:26 +0000, Shaw, Ray V CTR USARMY ARL (US)
wrote:
Anyone want to weigh in on this? At the very least, it would be nice if the check also
accepted the value of "none", and possibly the guidance should recommend this
setting.
So, had a look around some of the RHEL5 servers at work and they're
also
set to "static" not "none". A bit of a google search and I found
both
used on blog and howto's etc.
Taking a look at the actual SRPM, here's where the magic happens:
----------------------------------
sysconfig/network-scripts/ifup-eth
----------------------------------
# Old BOOTP variable
if [ "${BOOTP}" = "yes" ]; then
BOOTPROTO=bootp
fi
if [ "${BOOTPROTO}" = "bootp" -o "${BOOTPROTO}" =
"dhcp" ]; then
DYNCONFIG=true
fi
----------------------------------
Later on if DYCONFIG config is set to true, then it goes through
requesting a DHCP lease as expected etc.
The Disable DHCP client check specifies that the value of BOOTPROTO
should be "static". However, this doesn't list "static" as an
option:
https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Lin...
Should the check be for "none" instead?
I say no, but the remediation and
guidance should be in accordance with
the official documentation.
[Aside: I thought this might be a carryover from RHEL5, but the RHEL5
deployment guide lists the same options:
https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Lin...
However, all the RHEL5 clients I've checked have had it set to "static",
whereas the RHEL6 clients I've checked have it set to "none".
Is setting it to anything other than "bootp" or "dhcp" the equivalent
of setting it to "none"?
Looks like it. I think we should check for
BOOTPROTO = ("bootp" or
"dhcp" ) or BOOTP = "yes" and fail it either is true. I think
that's the
simplest logic that aligns with how the initscript makes it's
determination. We should obviously also check if this is still valid
for RHEL7. I think we should just blissfully ignore checking for
"static".
You know what, as I right this, I think I've convinced myself the other
way. Documentation says DHCP is disabled by setting to "none", lets
check for that. It also has the added advantage, of bringing configs in
line with best practice, even if "static" technically works because of
the coded implementation in the initscript. I think it would be an
opportunity to correct what seems like a common misconception. I know,
I've used "static" in the past, but that's mainly because of a bad
habit
that I picked up from Debian.
--
Cheers, Willo
--
Graham Williamson