Disable Avahi Server Software

Classification:

compliance

Framework:

Control:

Description

The avahi-daemon service can be disabled with the following command:

$ sudo systemctl mask --now avahi-daemon.service

Rationale

Because the Avahi daemon service keeps an open network port, it is subject to network attacks. Its functionality is convenient but is only appropriate if the local network can be trusted.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

SYSTEMCTL\_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL\_EXEC" stop 'avahi-daemon.service'
"$SYSTEMCTL\_EXEC" disable 'avahi-daemon.service'
"$SYSTEMCTL\_EXEC" mask 'avahi-daemon.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL\_EXEC" -q list-unit-files avahi-daemon.socket; then
 "$SYSTEMCTL\_EXEC" stop 'avahi-daemon.socket'
 "$SYSTEMCTL\_EXEC" mask 'avahi-daemon.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL\_EXEC" reset-failed 'avahi-daemon.service' || true

else
 >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Block Disable service avahi-daemon
 block:

 - name: Disable service avahi-daemon
 block:

 - name: Disable service avahi-daemon
 systemd:
 name: avahi-daemon.service
 enabled: 'no'
 state: stopped
 masked: 'yes'
 rescue:

 - name: Intentionally ignored previous 'Disable service avahi-daemon' failure,
 service was already disabled
 meta: noop
 when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - NIST-800-53-CM-6(a)
 - NIST-800-53-CM-7(a)
 - NIST-800-53-CM-7(b)
 - PCI-DSSv4-2.2.4
 - disable\_strategy
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed
 - service\_avahi-daemon\_disabled

- name: Unit Socket Exists - avahi-daemon.socket
 command: systemctl list-unit-files avahi-daemon.socket
 register: socket\_file\_exists
 changed\_when: false
 failed\_when: socket\_file\_exists.rc not in [0, 1]
 check\_mode: false
 when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - NIST-800-53-CM-6(a)
 - NIST-800-53-CM-7(a)
 - NIST-800-53-CM-7(b)
 - PCI-DSSv4-2.2.4
 - disable\_strategy
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed
 - service\_avahi-daemon\_disabled

- name: Disable socket avahi-daemon
 systemd:
 name: avahi-daemon.socket
 enabled: 'no'
 state: stopped
 masked: 'yes'
 when:
 - ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"avahi-daemon.socket" in socket\_file\_exists.stdout\_lines[1]'
 tags:
 - NIST-800-53-CM-6(a)
 - NIST-800-53-CM-7(a)
 - NIST-800-53-CM-7(b)
 - PCI-DSSv4-2.2.4
 - disable\_strategy
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed
 - service\_avahi-daemon\_disabled