Hi Automox Alive Community!

Previously, I added a worklet for addressing LLMNR security risk for Windows, and now I’m adding the same for Linux considerations. If you are unfamiliar, LLMNR stands for Link-Local Multicast Name Resolution and is a favorite vector among pen-testers and malicious threat actors for conducting man-in-the-middle attacks.

Evaluation:

#!/bin/bash

# LLMNR - Evaluation : This will check whether LLMNR has been disabled.
test_val='^LLMNR=no'
test_cfg='/etc/systemd/resolved.conf'

# Case-insensitvely check for value
if ($(grep -qi "$test_val" $test_cfg)); then
  # Compliant
  exit 0
else
  # Non-Compliant
  exit 1
fi

Remediation:

#!/bin/bash

# LLMNR - Remediation : This will disable LLMNR. (restart required)
test_val='^LLMNR=no'
test_cfg='/etc/systemd/resolved.conf'

sed -i 's/.*LLMNR=.*/LLMNR=no/g' $test_cfg

# Case-insensitvely check for value
if ($(grep -qi "$test_val" $test_cfg)); then
  # Compliant
  exit 0
else
  # Non-Compliant
  echo "LLMNR could not be toggled off."
  exit 1
fi

I’ve also added this script to my GitHub.