Disable DHCP client (UNCLASSIFIED)

Graham Williamson graham at williamsonsinc.id.au
Thu Jan 9 10:15:24 UTC 2014


On Wed, 2014-01-08 at 13:26 +0000, Shaw, Ray V CTR USARMY ARL (US)
wrote:
> 
> Anyone want to weigh in on this?  At the very least, it would be nice if the check also accepted the value of "none", and possibly the guidance should recommend this setting.
So, had a look around some of the RHEL5 servers at work and they're also
set to "static" not "none".  A bit of a google search and I found both
used on blog and howto's etc.

Taking a look at the actual SRPM, here's where the magic happens:

----------------------------------
sysconfig/network-scripts/ifup-eth
----------------------------------
# Old BOOTP variable
if [ "${BOOTP}" = "yes" ]; then
    BOOTPROTO=bootp
fi

if [ "${BOOTPROTO}" = "bootp" -o "${BOOTPROTO}" = "dhcp" ]; then
    DYNCONFIG=true
fi
----------------------------------
Later on if DYCONFIG config is set to true, then it goes through
requesting a DHCP lease as expected etc.


> The Disable DHCP client check specifies that the value of BOOTPROTO should be "static".  However, this doesn't list "static" as an option:
> 
> https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/s1-networkscripts-interfaces.html
> 
> Should the check be for "none" instead?
I say no, but the remediation and guidance should be in accordance with
the official documentation.  

> [Aside: I thought this might be a carryover from RHEL5, but the RHEL5 deployment guide lists the same options:
> 
> https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/5/html/Deployment_Guide/s1-networkscripts-interfaces.html#s2-networkscripts-interfaces-eth0
> 
> However, all the RHEL5 clients I've checked have had it set to "static", whereas the RHEL6 clients I've checked have it set to "none".  
> Is setting it to anything other than "bootp" or "dhcp" the equivalent of setting it to "none"?  
Looks like it.  I think we should check for BOOTPROTO = ("bootp" or
"dhcp" ) or BOOTP = "yes" and fail it either is true. I think that's the
simplest logic that aligns with how the initscript makes it's
determination.  We should obviously also check if this is still valid
for RHEL7.  I think we should just blissfully ignore checking for
"static".

You know what, as I right this, I think I've convinced myself the other
way.  Documentation says DHCP is disabled by setting to "none", lets
check for that.  It also has the added advantage, of bringing configs in
line with best practice, even if "static" technically works because of
the coded implementation in the initscript.  I think it would be an
opportunity to correct what seems like a common misconception.  I know,
I've used "static" in the past, but that's mainly because of a bad habit
that I picked up from Debian.

-- 

Cheers, Willo
--
Graham Williamson
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140109/45a08efa/attachment.sig>


More information about the scap-security-guide mailing list