documentation_complete: true

title: 'Minimize the DHCP-Configured Options'

description: |-
    Create the file <tt>/etc/dhcp/dhclient.conf</tt>, and add an
    appropriate setting for each of the ten configuration settings which can be
    obtained via DHCP. For each setting, do one of the following:
    <br />
    If the setting should <i>not</i> be configured remotely by the DHCP server,
    select an appropriate static value, and add the line:
    <pre>supersede <tt>setting value</tt>;</pre>
    If the setting should be configured remotely by the DHCP server, add the lines:
    <pre>request <tt>setting</tt>;
    require <tt>setting</tt>;</pre>
    For example, suppose the DHCP server should provide only the IP address itself
    and the subnet mask. Then the entire file should look like:
    <pre>supersede domain-name "example.com";
    supersede domain-name-servers 192.168.1.2;
    supersede nis-domain "";
    supersede nis-servers "";
    supersede ntp-servers "ntp.example.com ";
    supersede routers 192.168.1.1;
    supersede time-offset -18000;
    request subnet-mask;
    require subnet-mask;</pre>

rationale: |-
    By default, the DHCP client program, dhclient, requests and applies
    ten configuration options (in addition to the IP address) from the DHCP server.
    subnet-mask, broadcast-address, time-offset, routers, domain-name,
    domain-name-servers, host-name, nis-domain, nis-servers, and ntp-servers.  Many
    of the options requested and applied by dhclient may be the same for every
    system on a network. It is recommended that almost all configuration options be
    assigned statically, and only options which must vary on a host-by-host basis
    be assigned via DHCP. This limits the damage which can be done by a rogue DHCP
    server.  If appropriate for your site, it is also possible to supersede the
    host-name directive in <tt>/etc/dhcp/dhclient.conf</tt>, establishing a static
    hostname for the system. However, dhclient does not use the host name option
    provided by the DHCP server (instead using the value provided by a reverse DNS
    lookup).

severity: unknown
