documentation_complete: true

title: 'Minimize Served Information'

description: |-
    Edit /etc/dhcp/dhcpd.conf. Examine each address range section within
    the file, and ensure that the following options are not defined unless there is
    an operational need to provide this information via DHCP:
    <pre>option domain-name
    option domain-name-servers
    option nis-domain
    option nis-servers
    option ntp-servers
    option routers
    option time-offset</pre>

rationale: |-
    Because the configuration information provided by the DHCP server
    could be maliciously provided to clients by a rogue DHCP server, the amount of
    information provided via DHCP should be minimized. Remove these definitions
    from the DHCP server configuration to ensure that legitimate clients do not
    unnecessarily rely on DHCP for this information.

severity: unknown

references:
    nist: CM-7
