Uninstall dnsmasq Package
Description
dnsmasq is a lightweight tool that provides DNS caching, DNS forwarding and
DHCP (Dynamic Host Configuration Protocol) services.
The dnsmasq package can be removed with the following command:
Rationale
Unless a system is specifically designated to act as a DNS
caching, DNS forwarding and/or DHCP server, it is recommended that the
package be removed to reduce the potential attack surface.
Shell script
The following script can be run on the host to remediate the issue.
# CAUTION: This remediation script will remove dnsmasq
# from the system, and may remove any packages
# that depend on dnsmasq. Execute this
# remediation AFTER testing on a non-production
# system!
if rpm -q --quiet "dnsmasq" ; then
dnf remove -y "dnsmasq"
fi
Ansible playbook
The following playbook can be run with Ansible to remediate the issue.
- name: Ensure dnsmasq is removed
package:
name: dnsmasq
state: absent
tags:
- CCE-86063-5
- disable\_strategy
- low\_complexity
- low\_disruption
- low\_severity
- no\_reboot\_needed
- package\_dnsmasq\_removed
