---
title: "HOST-SVC-009 DHCP or DNS Server Installed or Enabled"
canonical: https://openvapt.com/checks/HOST-SVC-009.html
html: https://openvapt.com/checks/HOST-SVC-009.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-SVC-009 DHCP or DNS Server Installed or Enabled

Checks whether a DHCP server or an authoritative or recursive DNS server (BIND) is installed or enabled on a machine that is not a network server.

- Domain: Server
- Severity: Low
- Control category: Secure Configuration
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`
- CIS Controls v8: 4.8
- NIST CSF 2.0: PR.PS-01, PR.IR-01
- CWE: CWE-1188
- NIST SP 800-53 Rev. 5: CM-7, CM-7(1)
- Benchmark topic: DHCP and DNS servers are not installed unless required (CIS Controls v8 4.8) (topic only, no benchmark text)

## Why It Matters

A rogue DHCP server hands out addresses and gateways to the whole network segment, and BIND is a large, privileged network service with a long vulnerability history. Both belong on dedicated infrastructure hosts. On a web or application server they are either forgotten or an attacker's foothold. If this machine is one of the dedicated network infrastructure hosts that legitimately run it, record the reason in the suppression file so the finding stays visible but accepted.

## How It Detects

Reads installed packages from /var/lib/dpkg/status (only entries marked 'install ok installed'; /var/lib/dpkg/info/*.list is a fallback used only when the status file cannot be read) and the allow-listed rpm -qa, and looks for isc-dhcp-server, dhcp-server, kea-dhcp4-server, kea-dhcp6-server, bind9, bind, bind9-dnsutils-server. Reads the *.wants links under /etc/systemd/system (and asks the allow-listed systemctl is-enabled) for isc-dhcp-server.service, dhcpd.service, kea-dhcp4-server.service, named.service, bind9.service. Either an installed package or an enabled unit fails. Incomplete when no package database and no systemd unit directory could be read.

## How to Fix

apt purge isc-dhcp-server bind9  or  dnf remove dhcp-server bind , and  systemctl disable --now isc-dhcp-server named . If this machine is meant to be a DNS or DHCP server, record that in the suppression file and review NET-SVC findings for its configuration. Before removing a package, check that no application on this machine or the network still uses the service, and keep console access when the service is remote-access related.

## How to Verify

```
dpkg -l isc-dhcp-server dhcp-server kea-dhcp4-server kea-dhcp6-server bind9 bind bind9-dnsutils-server 2>/dev/null | grep '^ii' ; systemctl is-enabled isc-dhcp-server.service dhcpd.service kea-dhcp4-server.service named.service bind9.service 2>/dev/null
```

## Learn the Theory

- [P1 Linux Server Hardening](https://openvapt.com/academy/p1.md)
- [P22 Authentication Policy and Package Hygiene](https://openvapt.com/academy/p22.md)

## References

- [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go

Run it: `openvapt scan --only HOST-SVC-009`. Read it offline: `openvapt explain HOST-SVC-009`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-SVC-009.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.