# Ensure dhcp server services are not in use

A DHCP (Dynamic Host Configuration Protocol) server automates the assignment of IP addresses and network configuration to clients. **Necessity:** An unauthorized or unnecessary DHCP server on a network poses a significant security risk. It can be used by an attacker to launch man-in-the-middle (MITM) attacks by assigning malicious DNS servers or default gateways to clients, redirecting traffic through attacker-controlled systems. It can also cause network-wide denial-of-service (DoS) by issuing invalid IP addresses or exhausting the IP address pool. To minimize the system's attack surface and prevent these vulnerabilities, DHCP server services should only be running on dedicated, authorized servers. **Auditing and Remediation:** The audit script verifies whether the common Ubuntu DHCP server package, 'isc-dhcp-server', is installed. The remediation script ensures the system is secure by completely purging this package, removing all associated services and configuration files. **Recommended State Rationale:** The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Not Installed'. This is a binary control based on the principle of least functionality. Unless the server's explicit purpose is to provide DHCP services, the package must not be installed. There is no acceptable intermediate state, as the mere presence of the service, even if disabled, represents a potential risk of accidental activation or exploitation.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the installation status of the 'isc-dhcp-server' package. The script must return the string 'Installed' if the package is installed, and 'Not Installed' if it is not. The output should contain only this value and nothing else.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state. If the argument is 'Not Installed', the script must use 'apt-get purge -y isc-dhcp-server' to completely remove the package. The script must return 'true' on successful removal or if the package was already absent, and 'false' on failure.

