STIGQter: STIG Summary: Oracle Linux 6 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The DHCP client must be disabled if not needed.

DISA Rule

SV-209024r603263_rule

Vulnerability Number

V-209024

Group Title

SRG-OS-000480

Rule Version

OL6-00-000292

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

For each interface [IFACE] on the system (e.g. eth0), edit "/etc/sysconfig/network-scripts/ifcfg-[IFACE]" and make the following changes.

Correct the BOOTPROTO line to read:

BOOTPROTO=none

Add or correct the following lines, substituting the appropriate values based on your site's addressing scheme:

NETMASK=[local LAN netmask]
IPADDR=[assigned IP address]
GATEWAY=[local LAN default gateway]

Check Contents

To verify that DHCP is not being used, examine the following file for each interface.

# /etc/sysconfig/network-scripts/ifcfg-[IFACE]

If there is any network interface without a associated "ifcfg" file, this is a finding.

Look for the following:

BOOTPROTO=none

Also verify the following, substituting the appropriate values based on your site's addressing scheme:

NETMASK=[local LAN netmask]
IPADDR=[assigned IP address]
GATEWAY=[local LAN default gateway]

If it does not, this is a finding.

Vulnerability Number

V-209024

Documentable

False

Rule Version

OL6-00-000292

Severity Override Guidance

To verify that DHCP is not being used, examine the following file for each interface.

# /etc/sysconfig/network-scripts/ifcfg-[IFACE]

If there is any network interface without a associated "ifcfg" file, this is a finding.

Look for the following:

BOOTPROTO=none

Also verify the following, substituting the appropriate values based on your site's addressing scheme:

NETMASK=[local LAN netmask]
IPADDR=[assigned IP address]
GATEWAY=[local LAN default gateway]

If it does not, this is a finding.

Check Content Reference

M

Target Key

2928

Comments