← Rules Catalog
mediumservicesunverifiedrollback-safe

Ensure the unbound package is not installed

pkg-unbound-absent · RHEL ≥ 8 · 1 impl

Description

The unbound DNS resolver package must not be installed unless the system is operationally required to be a DNS server.

Rationale

An unnecessary DNS resolver daemon increases the attack surface and may serve unvalidated responses.

Check → Remediate

Checkpackage_state
name:
unbound
state:
absent
Remediatepackage_absent
name:
unbound

Framework references

STIG

V-280948 / RHEL-10-200060

NIST 800-53

CM-7
#package#dns