# Ensure dhcp server services are not in use

Necessity: An unauthorized DHCP server on a network can cause significant disruption and security risks. It can lead to denial-of-service attacks by issuing incorrect network configurations or IP address conflicts. Furthermore, a rogue DHCP server can be used for man-in-the-middle attacks by assigning a malicious DNS server or default gateway to clients, allowing an attacker to intercept or redirect network traffic. Adhering to the principle of least functionality, systems not explicitly designated as DHCP servers should not have this service running.

Auditing and Remediation: The audit script verifies the current state of the 'dhcpd' service using the systemd 'systemctl' command to determine if it is enabled, disabled, or not installed. The remediation script disables and stops the service, preventing it from starting automatically on boot or running in the current session, thus removing the immediate threat.

Recommended State Rationale:
- Basic/Moderate: ['disabled', 'not installed']. The fundamental requirement is that the service is not active. Disabling the service prevents it from automatically starting, which is a sufficient control for a basic level of security. If the package is not installed, the goal is also met.
- Strict: ['not installed']. The most secure configuration is to completely remove the DHCP server package from the system. This eliminates the possibility of the service being accidentally or maliciously enabled and reduces the system's overall attack surface by removing unnecessary software.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled', 'not installed']` |
| **Moderate** | `['disabled', 'not installed']` |
| **Strict** | `['not installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'dhcpd' service. The script should use 'systemctl is-enabled dhcpd'. If the command fails, indicating the service is not installed, the script must output 'not installed'. Otherwise, it must only output the returned status (e.g., 'enabled', 'disabled') without any extra text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument for the desired state. If the argument is 'disabled', the script must execute 'systemctl --now disable dhcpd' to stop and disable the service. The script must return 'true' on success and 'false' on failure.

