Description

dnsmasq is a lightweight tool that provides DNS caching, DNS forwarding and DHCP (Dynamic Host Configuration Protocol) services.

The dnsmasq package can be removed with the following command:

$ sudo yum erase dnsmasq

Rationale

Unless a system is specifically designated to act as a DNS caching, DNS forwarding and/or DHCP server, it is recommended that the package be removed to reduce the potential attack surface.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

#!/bin/bash

# CAUTION: This remediation script will remove dnsmasq
#	   from the system, and may remove any packages
#	   that depend on dnsmasq. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "dnsmasq" ; then

    yum remove -y "dnsmasq"

fi

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Ensure dnsmasq is removed
  package:
    name: dnsmasq
    state: absent
  tags:
  - CCE-90761-8
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_dnsmasq_removed