Skip to content
Log In

Disable Secure RPC Server Service (rpcsvcgssd)

An XCCDF Rule

Description

The rpcsvcgssd service manages RPCSEC GSS contexts required to secure protocols that use RPC (most often Kerberos and NFS). The rpcsvcgssd service is the server-side of RPCSEC GSS. If the system does not require secure RPC then this service should be disabled. The rpcsvcgssd service can be disabled with the following command: 
$ sudo systemctl mask --now rpcsvcgssd.service

Rationale

Unnecessary services should be disabled to decrease the attack surface of the system.

ID
xccdf_org.ssgproject.content_rule_service_rpcsvcgssd_disabled
Severity
Unknown
Updated

Remediation Templates

A Puppet Snippet

include disable_rpcsvcgssd
class disable_rpcsvcgssd {
  service {'rpcsvcgssd':
    enable => false,
    ensure => 'stopped',
  }
}

An Ansible Snippet

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity

script:kickstart

service disable rpcsvcgssd

OS Build Blueprint

[customizations.services]
masked = ["rpcsvcgssd"]

A Kubernetes Patch

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0

A Shell Script

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'rpcsvcgssd.service'
"$SYSTEMCTL_EXEC" disable 'rpcsvcgssd.service'
"$SYSTEMCTL_EXEC" mask 'rpcsvcgssd.service'