documentation_complete: true


title: 'Disable Client Dynamic DNS Updates'

description: |-
    Dynamic DNS allows clients to dynamically update their own DNS records.
    The updates are transmitted by unencrypted means which can reveal information
    to a potential malicious user. If the system does not require Dynamic DNS,
    remove all <tt>DHCP_HOSTNAME</tt> references from the
    <tt>/etc/sysconfig/network-scripts/ifcfg-<i>interface</i></tt> scripts. If
    <tt>dhclient</tt> is used, remove all <tt>send host-name <i>hostname</i></tt>
    references from the <tt>/etc/dhclient.conf</tt> configuration file and/or any
    reference from the <tt>/etc/dhcp</tt> directory.

rationale: |-
    Dynamic DNS updates transmit unencrypted information about a system
    including its name and address and should not be used unless needed.

severity: medium

references:
    cis-csc: 11,3,9
    cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05
    isa-62443-2009: 4.3.4.3.2,4.3.4.3.3
    isa-62443-2013: 'SR 7.6'
    iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4
    nist: CM-7(a),CM-7(b),CM-6(a)
    nist-csf: PR.IP-1
    srg: SRG-OS-000480-GPOS-00227

ocil_clause: 'client Dynamic DNS updates are not disabled'

ocil: |-
    To verify that clients cannot automatically update DNS records, perform the
    following:
    <pre>$ grep -i dhcp_hostname /etc/sysconfig/network-scripts/ifcfg-*</pre>
    <pre>$ grep -rni "send host-name" /etc/dhclient.conf /etc/dhcp</pre>
    The output should return no results.
